Privacy and Security Enable or Disable Microsoft Vulnerable Driver Blocklist in Windows 11

hader · 2026-10-24T04:30:22-0400

BruceR said:
Microsoft says it does use a list:

You can download the list:

The blocklist is shown in post #12.

This is Microsofts driver blacklist!
In a sense this is a different subject category completely; drivers that belongs to malicious software or has security holes in it.

Windows has some rules that every manufacture must obey in order to make sure it is not tampering with Windows security mechanisms. If a driver has security holes which can be exploited by criminals then Microsoft can't refuse a user to install that malicious piece of software. What it can do is to prevent the driver being loaded. All the drivers on that list falls in the following 3 category's:

(See: Microsoft recommended driver block rules)

Known security vulnerabilities that an attacker could exploit to elevate privileges in the Windows kernel

Malicious behaviors (malware) or certificates used to sign malware

Behaviors that aren't malicious but circumvent the Windows Security Model and an attacker could exploit to elevate privileges in the Windows kernel

Some driver names have some devious names like kprocesshacker.sys. If I take a look at pllkiller.sys I can see that this driver dates from the Windows 8.1 era and is used to elevates software in order to compromise Windows security:

PPL Bypass: Microsoft introduced PPL to protect critical processes (such as LSASS or antivirus software) from manipulation by other applications, even if those applications have administrator privileges. pllkiller.sys removes these restrictions.

Purpose: It is primarily used by security researchers and penetration testers for debugging or reading the memory of secure processes (such as with Mimikatz).

Risks and Malicious Use Although it has a legitimate open source origin on GitHub (originally developed by Mattiwatti), this technique or variants of it is also abused by malicious parties.

I see also a driver that looks familiar to me; had some troubles with it in the past: a driver (ASIO64.sys) from ASUS the belongs with a piece of software; Armoury Crate. It is placed on this blacklist because it has some unwanted behaviors;

It communicates directly with your motherboard hardware for temperature and fan monitoring.

It often triggers error messages in Windows 11 when Core Isolation (Memory Integrity) is enabled, because the driver is either too old or vulnerable.

It may also display a message stating that it is "corrupt or does not exist" following an incomplete software updates.

This is known for some while. This driver is old and has vulnerability's. ASUS knows this and is not securing this driver till this day. Armoury Crate is still shipped with the motherboards and can be downloaded. I find it unbelievable that a big manufacturer does not revise their own software that those security risk is a thing of the past.... This was the main reason why I de-installed that piece of software. It has (like Windows) also some questionable behaviors like sending data to ASUS. Despite I removed the software there was also a service left behind; AsusUpdateCheck but this was a service that I removed as leftover. But when I started the PC again it was back again. Found out that inside the BIOS was an option: Armoury Crate. When this was turned on this service was installed if it was removed. By turning that option off it stays away.

Windows is hardening their Windows Security and I think for one good reason; Security. If I look at this list? It is not complete; it is what's known. Cybercriminals are busy on a daily basis to find gaps and by things like Phishing mails, Malware etc. to get into our systems.

All these drivers has been looked at by security code specialists at Microsoft and is inspected for things that is unwanted. There are people that are wary for some workings of the drivers "What does this do?". They can send the drivers to Microsoft for inspections and they will investigate. Cybercriminals are always looking for ways to compromise Windows that is being used inside many Corporate company's. Once inside? They can steal data which they can sell. We are not the main intrest here. Some cybercriminals are trying lure us to sites in order to place Malware of Ransomware onto our systems. Each anti4virus and browser also use blacklists! It is a common practice. These lists are updated on a regular basis once the makers find out a site contains malicious software. Security becomes top priority nowadays because of those Cybercriminals and it's getting worse now with A.I..... It could find gaps and find a way to be exploited in a very short time. To short to come up with a patch. A.I. is also used for hardening software. It has Pros and Cons.

BruceR · 2026-10-24T05:39:12-0400

hader said:
This is Microsofts driver blacklist!
In a sense this is a different subject category completely; drivers that belongs to malicious software or has security holes in it.

Different from what? That's what this tutorial and topic is all about.

hader said:
All the drivers on that list falls in the following 3 category's:

(See: Microsoft recommended driver block rules)

So you do now accept that Microsoft uses a blocklist enabled by default in Windows, contrary to your earlier statements?

hader · 2026-10-24T10:54:18-0400

BruceR said:
Different from what? That's what this tutorial and topic is all about.

So you do now accept that Microsoft uses a blocklist enabled by default in Windows, contrary to your earlier statements?

Semantics. I never claimed that MS never was using a block driver list.
The whole subject has 2 parts;
- Blocked if a certificate is expired.
- A list of suspicious drivers.
Both methods are used to block drivers who does not meet the security standards.

I am do not have any drivers that fall in those category, so that option "blocklist for vulnerable Microsoft drivers" is turned one.
The main question was "Should I turn this on or off" I would say "on" for a very good reason.

BruceR · 2026-10-24T15:35:02-0400

hader said:
Semantics. I never claimed that MS never was using a block driver list.

You did. Twice:

hader said:
FYI: Microsoft does not use a blacklist!!!

hader said:
This driver blocked "list" is not a list.

hader · 2026-10-25T04:40:13-0400

BruceR said:
You did. Twice:

OK. I am guilty. Happy now? I know of the first one until I saw that second (list) appear. My bad. But I could not find the content of that list. After that MS page it seems there is one. Not sure that list is public because it is changing a lot.

Search

Privacy and Security Enable or Disable Microsoft Vulnerable Driver Blocklist in Windows 11

KB5020779—The vulnerable driver blocklist after the October 2022 preview release | Microsoft Support

Microsoft recommended driver block rules

Turn On or Off Microsoft Vulnerable Driver Blocklist in Windows Security

Turn On or Off Microsoft Vulnerable Driver Blocklist using REG file

Attachments

hader

Well-known member

My Computers

At a glance

At a glance

BruceR

Well-known member

My Computer

At a glance

hader

Well-known member

My Computers

At a glance

At a glance

BruceR

Well-known member

My Computer

At a glance

hader

Well-known member

My Computers

At a glance

At a glance

Similar Windows 11 Tutorials

Latest Support Threads

Latest Tutorials

Privacy and Security Enable or Disable Microsoft Vulnerable Driver Blocklist in Windows 11

Turn On or Off Microsoft Vulnerable Driver Blocklist in Windows Security

Turn On or Off Microsoft Vulnerable Driver Blocklist using REG file

Attachments

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar Windows 11 Tutorials

My Computers

My Computer

My Computers

My Computer

My Computers