Microsoft tells crusty old kernel drivers to get with the Windows Hardware Compatibility Program Microsoft is removing trust for kernel drivers that haven't been through the Windows Hardware Compatibility Program (WHCP) in a bid to further secure the Windows kernel. The company is targeting kernel drivers signed by the long-deprecated cross-signed root program. Although all the certificates associated with the program …
Now quit monkeying around with Windows APIs so the old drivers break. And users are left with giant paperweight printer-like objects sitting on their desks. Or accept the fact that only the largest manufacturers can afford to keep up with your revisions. And they'll all move over to platforms that don't try to do everything in kernel space. Requiring that obsession with security.
I see this so many times from companies like Microsoft (actually, very few seem to be immune) where they have the testing models reversed. Once the code it written it is reasonable to assume it does what you intended and at that point you should be testing to ensure it doesn't do what you do not want it doing. This is the one time you want ill-informed users testing it out so they can try to break it or get to places they are not meant to be.
Whether or not the cross-signed certificates should have been considered, proper testing should have shown it created a scenario where security was now reliant on the weakest link and even created the way for a 3rd/4th party to create malicious code which Microsoft would accept as good.
The powershell command "Get-WmiObject Win32_PnPSignedDriver | select devicename, signer" looks like a good start. "driverquery /si" also shows which drivers are signed, but not by whom.
On a normal desktop system with no weird devices attached I just have two signers, "Microsoft Windows Hardware Compatibility Publisher" and "Microsoft Windows". If anything signed by the former gets disabled, then I only stand to lose my graphics card, printer, webcam and a selection of motherboard on-board elements such as network and sound. It is not an old system.
It's not dumb. It's knowing your target market.
95% (maybe 99%) of Windows users don't understand or care about any of this stuff. And quite frankly that's the way it should be. I don't have to be an automotive technician or physicist to drive my car so why should I have to have a degree in (or knowledge equivalent to that) in computer science to use my computer? Those people whose jobs or responsibilities require them to understand the arcane stuff will know about PowerShell and will be able to use it as required to perform their administrative tasks.
Frankly your attitude is a large part of why Linux has never succeeded on the desktop. You expect far too much technical knowledge from your users. Computers are supposed to be enabling devices for everyone to use, not some kind of intelligence test for the technical elite.
> detect and identify such drivers
Task Manager?
Taskman
Processes
RightClick on a process
Properties
Digital Signatures
{example} Ultraedit 22 is signed IDM Computer... Nov 2015 --- countersigned Starfield Services (eaten by Amazon 2016}
{example} Thunderbird signed Mozilla Corporation Dec 24 --- countersign DigiCert Timestamp 2024
This is in Win7 and yes it gets VERY tedious.
> RightClick on a process / Properties / Digital Signatures
[ ] Fully read article
[ ] Understood Article
[ ] Read headline
[ ] Understood headline
If ONLY you would have read and understood words number five and six from the headline alone, "kernel drivers", that alone would have been enough.
IF you'd have written Process Hacker, which is now called System Informer, directed to "Services", which lists started drivers as well.... A few mouse clicks later you can see and check the signature in a graphical UI... Though the powershell variant is a lot faster for us admins.
Oh, I totally forgot: Download Powershell 5.1 for Win7 / Server 2008 R2, it will give you that command. Though you don't need it anyway, since well, Windows 7...
I can think of quite a few bits of hardware I've used over the years that relied on ancient drivers, in some cases board programmers that had the latest drivers dating from 20 odd years ago.
But I'm sure it'll all be fine and not lead to daft workarounds to get things working. Again.
As part of my work I have a number of items of legacy equipment including an ancient scanner that was designed for a specific size of photographic plate. There is no modern equivalent that works with these plates.
The last time the equipment and driver were updated were for Windows XP. Believe it or not the scanner still works with W10!
Time to find an old XP machine and air gap it from the internet.
I can, however, see lots of perfectly useful older gear being junked as a result of this.
Always wondered why Microsoft never chose to release an extended-extended-extended version of XP at several times the original price for exactly this scenario.
There's millions of ancient devices like that still out there (which work perfectly fine) and admins basically have two choices: play Russian Roulette buying an XP machine off eBay, or just keep a VLK ISO and key around (but don't admit it).
Microsoft could employ several dozen people keeping XP around for just this reason and charging more than XP cost when it was new. Most IT departments would gladly pay the $500 or whatever to not engage in, uh, what it takes to keep running XP in 2026.
But Microsoft management wants the performative purge of everything which has been working well for a long time. Out with the old, in with the new!
Why find an old XP machine and air gap it? instead of finding a Win10 machine and airgaping that?
You said it yourself. The XP era drivers work on win10
As a matter of fact, depending on the type of contract yor company has with microsoft, you may not need to airgap until oct 26, or oct 28, or Jan 31...
Easier to source compatible modern machines with less/no use.
Easier to find people able to maintain said machine
Less (known) security holes in Win10 than in XP...
It appears I was insufficiently clear in my OP.
I meant to imply Microsoft has the computer hardware manufacturers over a barrel, and can charge those computer hardware manufacturers whatever fees Microsoft desires, before Microsoft signs that computer hardware manufacturer's drivers with the Redmond Seal of Approval.
They control the OS and now they want to control what hardware you run it on.
This is, of course, nothing new, but it's interesting quite how many changes they've gone through and how many devices and drivers they've obsoleted along the way so that only people who pay to constantly update their driver signing etc. are able to keep their hardware running.
So glad I just use an OS that... does what I ask of it and runs on whatever hardware I want it to.
Controlling the hardware is not an unreasonable ask for an OS developer...as long as the requirements are reasonable.
By my reckoning, Microsoft has been in the OS business for over 30 years, and their products seem to have developed signs that their engineers and managers have little to do but add "bells and whistles" to what should otherwise be fairly basic products: a word processor, a spreadsheet, a presentation tool, email, and a networked operating system. One could be forgiven for thinking that all of these products are basically "solved problems", requiring little more development effort than bug fixes and the occasional improvement to keep up with the times. Microsoft has managed, with every release, to add features no one has asked for and to introduce more problems than they solve. And, yes, I realise that a multibillion dollar corporation has a strong will to survive, and the accountants insist on an ever increasing share price. But, at the cost of pissing off the users? Seems self-defeating.
Linux (sorry, *GNU/Linux* to keep a certain poster satisfied), on the other hand...makes no bones about requiring a certain level of competence in their users :-) I believe there's a coffee cup with a saying to that effect. Linux may not be for everyone, but to me, it's a heck of a lot better than trying to keep up with Microsoft's delusions that everyone needs what they're pushing this week.
