Windows’ vulnerable driver blocklist stops specified kernel drivers from loading when Microsoft has identified them as exploitable, malicious, or capable of bypassing Windows’ security model. That can remove a common route to kernel compromise and prevent failures caused by a specifically blocked driver, but it is not a universal quality filter: it does not identify every unstable driver, and Microsoft warns that blocking a driver can itself cause software or hardware problems and, rarely, a blue screen.
Think of the blocklist as one security and reliability layer. It is most effective when Windows is kept current, memory integrity or another App Control policy is active where appropriate, and administrators test policy changes before enforcing them.
As an Amazon Associate I earn from qualifying purchases.
What the Windows vulnerable driver blocklist actually does
A Windows driver runs with powerful privileges. A vulnerable kernel-mode driver can give an attacker a path from an ordinary application to code execution inside the Windows kernel, where security boundaries are weakest. Some drivers are also signed yet contain known weaknesses, malicious behavior, certificates associated with malware, or design choices that bypass the Windows Security Model.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Microsoft’s vulnerable driver blocklist is a deny list for those identified drivers. When the applicable Windows policy sees a listed driver, it prevents that driver from loading. The list covers non-Microsoft-developed drivers in three broad categories:
#1 Best Overall
- 【Quality materials and easy installation】TPM 2.0 Security Module is made of high quality material and is well made for long life.It is easy to install, lightweight and compact, and its easy integration makes it a breeze to install and operate quickly.
- 【Working environment】The TPM2.0 Security Module is compatible with GC-TPM2.0_S. Interface: LPC, TPM IC: SLB9665, Pin Connector: 12Pin.Please check compatibility before purchasing.
- 【Reliable Work】The TPM 2.0 Module is a highly reliable cryptographic processor that brings an extra layer of security to your Windows computer. With its advanced encryption technology, you can perform secure operations such as generating, storing, and restricting the use of cryptographic keys, ensuring that your system is protected from unauthorized access.
- 【High-quality replacement】high-quality professional use, the function is the same as the original model, stable performance, a good replacement of the original damaged old safety module.
- 【Model Support】Each security module is tested before it leaves the factory and is 100% perfectly works well.Therefore, Please confirm that your motherboard supports TPM2.0 technology.
- Known exploitable vulnerabilities: flaws that can be used to elevate privileges into the Windows kernel.
- Malicious behavior or abused signing certificates: drivers or certificates associated with malware.
- Security-model bypasses: behavior that is not necessarily malicious by itself but can be abused to obtain kernel privileges.
Microsoft maintains the list with hardware vendors, original-equipment manufacturers, and the security community. The intent is targeted prevention, not a judgment that every driver outside the list is safe or well written.
How this can reduce crashes—and why it is not a crash guarantee
A faulty driver can crash Windows by dereferencing invalid memory, mishandling hardware interrupts, corrupting kernel data, or failing under a particular device and workload combination. If that exact driver is on the blocklist, stopping it before it initializes can prevent crashes that would otherwise occur during startup or device use.
However, Microsoft does not publish a crash count or prevention percentage for the blocklist. The list is not a general-purpose stability detector. A poorly written driver may be unstable without meeting the security criteria for inclusion, and a newly discovered vulnerable driver may not yet be listed. Microsoft explicitly says the blocklist is not guaranteed to cover every driver found to have vulnerabilities.
Blocking can also have a cost. A device, application, or security product that depends on a denied driver may lose functionality. In rare cases, a compatibility problem can lead to a blue screen. The practical conclusion is precise: the blocklist can prevent failures involving known, listed drivers while reducing a kernel-attack path; it cannot promise that a PC will never crash because of a driver.
When the protection is enabled
Windows 11 defaults
Microsoft says the vulnerable driver blocklist has been enabled by default on all devices since the Windows 11 2022 update. Exact enforcement still depends on the Windows edition, build, and security configuration.
Rank #2
- 【Wide Compatibility – Gigabyte & ASUS】 Specifically designed for Gigabyte and ASUS desktop motherboards with a 20-1 pin (2x10 / GA 20-1) 2.54mm pitch LPC TPM header. Ideal for upgrading to TPM 2.0 on DDR4 systems. (Note: NOT compatible with 12-pin, 2x6, or 14-pin headers).
- 【Windows 11 Readiness】 An essential hardware upgrade to meet Windows 11 security requirements. Ensure your system stays secure and up-to-date with a dedicated hardware TPM 2.0 module without replacing your entire motherboard or CPU.
- 【Advanced Security & Encryption】 Powered by the standalone Infineon SLB9665 encryption processor. This module securely stores cryptographic keys for software like Windows BitLocker, providing a robust layer of hardware-based security for your data.
- 【Platform Limits – No Laptops】 Optimized for Desktop motherboards from the DDR4 era (X99 series and newer). Not compatible with laptops or legacy DDR3 systems. Please verify your motherboard's header layout (2x10 pins) before ordering.
- 【Easy Setup & BIOS Note】 Simple plug-and-play installation takes only minutes with no tools required. IMPORTANT: After installation, you MUST enable "Security Device Support" or "Intel PTT / AMD fTPM" in your BIOS settings for Windows to recognize the module.
Configurations that enforce the list
The list is enforced when memory integrity (also called hypervisor-protected code integrity, or HVCI), Smart App Control, or S mode is active. Microsoft’s inbox-policy documentation identifies the Microsoft Windows Driver Policy as a kernel-only policy that is active by default on Windows 11 version 22H2, Windows in S mode, Windows 11 SE, and systems where memory integrity is enabled. Windows Server 2016 is an exception to the broad enforcement guidance.
Most new Windows 11 devices ship with HVCI enabled by default, according to Microsoft’s recommended-rules guidance. Older hardware, firmware, or drivers may not meet HVCI’s requirements, so a device can have a different effective state even when it is running a recent Windows release.
Keeping the list current
Microsoft describes a quarterly blocklist update cadence. List changes can also arrive through monthly Windows servicing, so normal Windows updates are part of the maintenance process. Administrators that need the latest recommended list can use the App Control for Business policy Microsoft publishes with its guidance rather than waiting for a future feature update.
How the blocklist relates to HVCI, ASR, and App Control
Several Windows protections mention vulnerable drivers, but they operate at different points in the lifecycle. Confusing them can lead to a false assumption that a blocked file has been removed or that every attack path is covered.
| Protection | What it controls | Who typically manages it | Important limitation |
|---|---|---|---|
| Vulnerable driver blocklist | Whether specified listed kernel drivers may load | Built-in Windows security policy; users can manage the setting in Windows Security on supported systems | It is not guaranteed to include every vulnerable or unstable driver |
| Memory integrity (HVCI) | Virtualization-based code integrity for kernel code; in documented configurations it also enforces the blocklist | Windows Security or organizational policy | Requires compatible hardware, firmware, and kernel drivers |
| Attack Surface Reduction rule “Block abuse of exploited vulnerable signed drivers” | Stops an application from writing a vulnerable signed driver to disk | Organization-managed Microsoft Defender policy | It does not stop an already-present driver from loading |
| App Control for Business | Kernel-enforced allow and deny policy, including driver-loading decisions | Administrators | Policy changes need testing; a driver already running is blocked after reboot |
The distinction between writing and loading is especially important. ASR can stop a vulnerable signed driver from being dropped onto the disk, while the blocklist or an App Control policy can prevent a listed driver already on the disk from loading. Using both addresses two different stages.
Rank #3
- TPM 2.0 module for Asus motherboard.
- TPM 2.0 module chip 2.0mm pitch, 2x7P, 14 pin security module
- LPC 14 Pin for AsusTPM chip is better compatible with DDR4 memory module of motherboard, built in support memory type higher than DDR3! Supported states may vary by motherboard specification.
- Note: Don't support laptops and motherboards prior to X99; Don't support DDR3 memory.
- Packing list:1x TPM 2.0 Module for ASUS
Check the setting on a personal Windows PC
For an ordinary user, the supported management point is the Windows Security app. Open Windows Security and review the Device security and Core isolation area, including the Memory integrity status where it is shown. The labels and available switches vary by Windows edition and hardware. If Windows reports that a driver is incompatible with memory integrity, record the driver name and version before changing anything; that information identifies the software that needs an update.
Do not treat a switch that is unavailable or turned off as proof that no driver protections exist. Smart App Control, S mode, App Control policies, and edition-specific inbox policies can change enforcement independently.
Verify policy state as an administrator
Use Citool
Microsoft points administrators to citool.exe for checking App Control and inbox policy state. Run it from an elevated command prompt or PowerShell session and inspect the listed policy names, identifiers, and enforcement status. The inbox policy is named Microsoft Windows Driver Policy and has this identifier:
{d2bda982-ccf6-4344-ac5b-0b44427b6816}Use the CodeIntegrity event log
Event Viewer provides a second verification method:
- Open Event Viewer.
- Go to Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
- Filter or search for policy-activation event 3099.
- Match the policy name and identifier with the policy you intended to activate.
Event 3099 confirms policy activation; it does not by itself prove that every driver on the computer is compatible. Review related CodeIntegrity events when troubleshooting a blocked device.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
- TPM 2.0 module for ASROCK motherboard.
- TPM 2.0 module chip 2.0mm pitch, 2x9P, 18 pin security module for ASROCK
- LPC 18 Pin for TPM chip is better compatible with DDR4 memory module of motherboard, built in support memory type higher than DDR3! Supported states may vary by motherboard specification.
- Note: Don't support laptops and motherboards prior to X99; Don't support DDR3 memory.
- Packing list:1x TPM 2.0 Module for ASROCK
Deploy the recommended App Control blocklist in an organization
Manual policy deployment is an administrator task. Everyday users should use Windows Security rather than copying policy binaries. Before enforcing a new policy across production machines, use a pilot group and audit mode.
- Download Microsoft’s App Control policy refresh tool and the blocklist binaries from the administrator guidance for the current recommended policy.
- Choose the audit-only form for initial testing, or the enforced form when testing has demonstrated compatibility.
- Rename the policy file to
SiPolicy.p7b. - Place it in
%windir%System32CodeIntegrityon the test computer. - Run the policy refresh tool as an administrator.
- Restart the computer when required. If a driver that the new policy would block is already running, the reboot is required before the block takes effect.
- Open the CodeIntegrity Operational log and review the would-be block and policy-activation events, including event 3099.
- Update, replace, or remove software that depends on a denied driver before moving from audit to enforcement.
Microsoft’s published recommended policy contains Allow All rules. On Windows versions that support multiple policies, Microsoft recommends deploying that policy alongside existing App Control policies. If it must be merged with a policy that uses an explicit allowlist, remove the Allow All rules before merging. Do not casually combine kernel policies; an incorrect merge can permit more than intended or disrupt required drivers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when a driver is blocked
Identify the exact component
Use the CodeIntegrity event details, the Windows Security incompatible-driver message, or the affected application’s documentation to identify the driver file, publisher, and version. A generic message such as “memory integrity cannot be enabled” is not enough to choose a replacement.
Install a supported update
Obtain a newer driver from the hardware or software maker’s normal support channel, then verify that it is intended for the exact Windows edition and device. Restart and retest the application or hardware. Do not simply rename a driver or disable security controls to make an old component load.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHandle a business-critical conflict
For an essential device that stops working, move the machine to the audit or pilot ring according to organizational policy, document the exception, and seek a patched driver. A temporary exception should be narrower than disabling all driver protections. Re-enable enforcement after the vendor update is validated.
Best Value
- Independent TPM Processor: The remote card encryption security module uses an independent TPM encryption processor, which is a daughter board connected to the main board.
- High Security: The TPM securely stores an encryption key that can be created using encryption software, without which the content on the user's PC remains encrypted and protected from unauthorized access.
- PC Architecture: TPM module system components adopts a standard PC architecture and reserves a certain amount of memory for the system, so the actual memory size will be smaller than the specified amount.
- Scope of Application: TPM modules are suitable for GIGABYTE for 11 motherboards. Some motherboards require a TPM module inserted or an update to the latest BIOS to enable the TPM option.
- Easy to Use: 12Pin remote card encryption security module is easy to use, no complicated procedures are required, and it can be used immediately after installation.
Recover from a startup failure
If enforcement causes a boot loop or repeated blue screens, use the organization’s tested Windows recovery procedure to reach Safe Mode or the Windows Recovery Environment, undo the recently deployed policy change, and restore the last known-good driver or policy. Record the CodeIntegrity events and crash information before redeploying; otherwise the same incompatibility can return.
Why audit-first deployment matters
App Control policies are enforced by the Windows kernel and take effect early in boot. That gives them strong protection but leaves little room for an untested rule to fail harmlessly. Audit mode records what would have been denied without immediately preventing the driver from loading. Administrators can review those events across representative hardware, security tools, VPN clients, backup agents, and specialized peripherals.
A useful pilot checks cold boots, restarts, sleep and resume, device installation, firmware updates, and the applications that load kernel components. Include older systems because HVCI compatibility and legacy drivers are common sources of differences between machines. Only after the audit log is clean should enforcement expand in stages.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Common misconceptions
- “The blocklist removes the driver.” It controls loading. The file may remain on disk and can still require an update or uninstall.
- “ASR and the blocklist are duplicates.” ASR targets an application writing a vulnerable signed driver to disk; the blocklist and App Control target loading.
- “A signed driver is automatically safe.” Signing establishes an identity and integrity check, not freedom from exploitable flaws.
- “Turning on HVCI guarantees compatibility.” HVCI strengthens code integrity but can expose older, incompatible drivers and has hardware and firmware requirements.
- “A blocked driver proves Windows is malfunctioning.” A block can be the intended security decision. The next step is to find a maintained replacement, not to assume the policy is wrong.
Choosing the right level of protection
| Situation | Practical approach | Reason |
|---|---|---|
| Home PC with supported Windows 11 hardware | Keep Windows updated and leave the built-in driver protections and memory integrity enabled unless a specific compatibility issue is documented. | Provides baseline protection with little policy administration. |
| Older PC with a legacy driver | Identify and replace the driver; test memory integrity before making a permanent exception. | Disabling protection may restore a device but preserves the underlying risk. |
| Managed fleet | Use audit-mode App Control policies, inspect CodeIntegrity events, then enforce in staged rings. | Reduces the chance that a legitimate kernel component is blocked across the organization. |
| High-risk or tightly controlled environment | Combine the blocklist with HVCI, ASR, and a carefully maintained App Control policy. | These controls address different stages and attack paths. |
Bottom line for crash prevention
Windows’ vulnerable driver blocklist is valuable because it prevents named, high-risk kernel drivers from loading. That can stop crashes tied to those drivers and closes a route attackers use to reach kernel privileges. Its boundaries matter just as much: no published figure shows how many crashes it prevents, the list cannot cover every vulnerable or unstable driver, and an ill-tested block can create a compatibility failure of its own.
For personal computers, keep Windows serviced and investigate incompatible-driver notices rather than turning off protections reflexively. For organizations, verify the active policy, audit new rules, review CodeIntegrity events, update affected drivers, and reboot when a previously running driver must be stopped.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
