Ben Cole Checking a single device for cross-signed driver blocks Why this script The Windows Driver Policy, which removes default trust for kernel drivers signed under the legacy cross-signed program, isn't new to 26H2. It shipped in the April 2026 update for Windo... 26H2 Driver signing Endpoint Management Intune Windows 11 7 Oct 2026
Ben Cole Finding cross-signed driver activity with Advanced Hunting in Defender For Endpoint From the April 2026 cumulative update, Windows enforces a new kernel driver policy that removes trust for drivers signed under the legacy cross-signed root program. Each device starts in evaluation mo... 26H2 Advanced Hunting Defender for Endpoint Driver signing KQL 7 Oct 2026