What does Windows error code 4576 (ERROR_PLATFORM_MANIFEST_NOT_SIGNED) mean?

ERROR_PLATFORM_MANIFEST_NOT_SIGNED

The Platform Manifest file was not properly signed.

ERROR_PLATFORM_MANIFEST_NOT_SIGNED is Win32 error 4576 (0x11E0) and belongs to Platform Manifest authorization.

Likely causes

• the Platform Manifest lacks a valid trusted signature.
• the active platform identity disagrees with manifest hash, signature, certificate chain, timestamp, and provisioning source.
• the provisioning pipeline did not obtain a correctly signed manifest from the trusted platform authority and reject unsigned replacements.

Troubleshooting steps

• Record manifest hash, signature, certificate chain, timestamp, and provisioning source.
• Record device identity and the active Platform Manifest generation.

What to verify

Verify whether the Platform Manifest lacks a valid trusted signature. Check manifest hash, signature, certificate chain, timestamp, and provisioning source, the device identity, and the active Platform Manifest generation.

Handling, retry, and recovery

Obtain a correctly signed manifest from the trusted platform authority and reject unsigned replacements. Preserve the artifact and authorization evidence before changing provisioning state.

Practical example

A deployment pipeline copies a generated manifest before its signing stage; the device refuses to activate it.

Developer and administrator guidance

Validate the signature over the exact manifest bytes, then inspect the signer chain, timestamp, and provisioning trust anchors. Regenerating or editing the manifest after signing invalidates the evidence. Deploy only a manifest signed by the platform authority accepted on this device.

References

• Microsoft: System Error Codes (4000–5999) — reference for error 4576.
• Microsoft: How System Guard protects Windows — reference for error 4576.
• Microsoft: Windows security hardware — reference for error 4576.