| Previous | Next |
| STATUS_VALID_IMAGE_HASH | STATUS_VALID_STRONG_CODE_HASH |
STATUS_VALID_CATALOG_HASH
A catalog supplied the successful integrity match
Windows can authorize a file through a signed catalog rather than an embedded signature in the file itself. This status indicates that the calculated hash matched a catalog member accepted by the current integrity evaluation. The catalog signature authenticates the collection, while the member hash binds the individual file to that collection.
Copying only the binary to another installation can change the result if the required catalog is absent, not trusted, or outside the catalog databases searched by the verifier. Conversely, the file can remain byte-for-byte unchanged while a catalog trust or policy change alters whether it is accepted.
What to inspect
- Identify the catalog file and catalog member used for the match, not only the binary that was loaded.
- Verify the catalog signature, certificate chain, timestamp, and current policy acceptance independently of the member hash.
- Confirm that the calculated digest uses the expected Authenticode or catalog hashing rules.
- Compare catalog installation and Code Integrity logs when the same file succeeds on one system and fails on another.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: App Control file rule and Authenticode hashes
- Microsoft: SignTool
- Microsoft: Code Integrity event log messages
Looking for a different code? Search another status or error code.