[fasmotol]

Hi, kernelmode.
The problem is: i gotta xpsp3-32 and 7sp1-32; Need to block all unsigned drivers when they try to load; That's what i've done for that:
1) xpsp3-32:
Set key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Driver Signing\BehaviorOnFailedVerify to 2 (Block); Tried to set 1(Warn);
Set "Block unsigned drivers" in UI (noticed that it doesn't effect to registry key mentioned before);

2) 7sp1-32:
bcdedit -set TESTSIGNING ON
bcdedit reported that operation completed successfully;

But i still can load unsigned driver (assembled through VisualDDK - simple bsod-gen in 2 lines - a very vivid result). If it matters i load drivers through kmdmanager.

1)So, as i suspect there can be other registry vars that really control driver signing. Perhaps i've modified a wrong one.
2)I have no gpedit on 7sp1-32, cause it's HB edittion. I've failed to find any useful vars in registry.

[EP_X0FF]

2) 7sp1-32:
bcdedit -set TESTSIGNING ON
bcdedit reported that operation completed successfully;

This turn on test mode actually to be able to load test-signed drivers.

Have you tried gpedit.msc? LPC->UC->Admin Templates->System->DriverInstallation (edit: I see you cant use it)

and this

bcdedit.exe - set loadoptions ENABLE_INTEGRITY_CHECKS

if it wont work I might suggest you remove SeLoadDriverPrivilege from current user programmatically :)

[fasmotol]

bcdedit.exe - set loadoptions ENABLE_INTEGRITY_CHECKS

This operation completed successfully, but nothing has changed - still can load driver.
Rofl, i use some "wrong" win. Thanks for fast reply, though.
Perhaps something about xp?

[EP_X0FF]

Perhaps something about xp?

secpol.msc -> Local Policies -> User Rights Assignment -> Load and Unload driver, remove admin. Windows will load OK, but something may stop working after.

As a feature you asking, probably you misunderstood the purpose of it. It blocks "installation" of unsigned drivers through INF/CAB (like in some driver packs for example), not blocks "loading".

[fasmotol]

As a feature you asking, probably you misunderstood the purpose of it. It blocks "installation" of unsigned drivers through INF/CAB (like in some driver packs for example), not blocks "loading".

Stupid me. That's right. I misunderstood the technology - thought any code for r0 must be signed. Theme can be closed.
Thanks, EP_X0FF.