| Previous | Next |
| STATUS_FILE_LOCKED_WITH_WRITERS | STATUS_VALID_CATALOG_HASH |
STATUS_VALID_IMAGE_HASH
The executable image hash passed the selected integrity policy
This is a success status from image-integrity processing. It means the hash calculated over the PE image matched an allowed or expected value for the policy being evaluated. The relevant digest is commonly an Authenticode-style image hash, which is not necessarily identical to a flat SHA digest of every byte in the file.
A valid image hash does not by itself prove that every trust decision succeeded. Signature chain validation, catalog membership, signer rules, revocation checks, and application-control policy can be separate stages. Diagnostics should therefore retain the policy result and the exact hash algorithm rather than treating this status as a universal trust verdict.
What to inspect
- Record the full path, file identity, hash algorithm, calculated digest, and policy or verifier that returned the status.
- Distinguish an embedded-signature image hash from a conventional whole-file hash produced by a general hashing tool.
- Check whether later validation used signer, catalog, publisher, path, or managed-installer rules in addition to the hash.
- Preserve the original image before comparing results across machines because servicing or repackaging can change its digest.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: App Control file rule and Authenticode hashes
- Microsoft: verifying the signature of a PE file
- Microsoft: PE and COFF format
Looking for a different code? Search another status or error code.