Microsoft does provide a way to re-enable SECDRV.
- Install a game that brings (a recent version of)
SECDRV.sys
. - Install the Windows 10 SDK from Get the standalone Windows 10 SDK.
Just install all components. - Start PowerShell as an administrator.
- Find
makecat.exe
,makecert.exe
andsigntool.exe
and add the path to your PATH in System Properties, Environment Variables.
The ones in a x86 subfolder are always OK on all Intel architecture chips. No need to match the hardware or the OS bitness.$SdkToolsPath = dir -Path "${env:ProgramFiles(x86)}\Windows Kits\10" -Recurse -Directory | where { $n = $_.FullName; $_.BaseName -eq "x86" -and [System.IO.File]::Exists("$n\makecert.exe") -and [System.IO.File]::Exists("$n\makecat.exe") -and [System.IO.File]::Exists("$n\signtool.exe") } | sort CreationTime | select -Last 1 $env:Path = "$env:Path;$($SdkToolsPath.FullName)"
- Create a new folder in your Downloads folder
$WorkingDirectory = "$env:UserProfile\Downloads\SECDRV" if (-not (Test-Path $WorkingDirectory)) { mkdir $WorkingDirectory | Out-Null }
- Run all further commands in a PowerShell prompt as Administrator in the folder you created.
cd $WorkingDirectory
- Copy
SECDRV.sys
in it. If it's an old version, replace it with this one downloadable here. Its from September 2006.# Using curl (Windows 10 has it inbox) curl.exe -OL https://github.com/ericwj/PsSecDrv/raw/master/tools/SECDRV/SECDRV.sys # Using PowerShell or PowerShell Core iwr -Uri https://github.com/ericwj/PsSecDrv/raw/master/tools/SECDRV/SECDRV.sys -OutFile SECDRV.sys
- Enable test signing boot mode.
bcdedit /set "{current}" testsigning on
- Pick a subject - any subject, but include the text "SECDRV" in it
$Subject = "SECDRV.sys Published by \\$env:ComputerName\$env:UserName on $("{0:yyyy-MM-dd HH:mm}" -f [datetimeoffset]::Now)"
- Create a root certificate.
# try this makecert -r -sr LocalMachine -ss My -n $Subject # if it doesn't work, use this makecert -r -sr LocalMachine -ss My -n "CN=$Subject"
- Open Local Machine Certificates.
certlm.msc
- Go to Personal, Certificates and select the certificate created, there usually is only one, or match the subject, right click Copy.
- Go to Trusted Root Certification Authorities, Certificates. Paste.
- Go to Trusted Publishers, Certificates. Paste.
- Make a text file called
SECDRV.cdf
in the folder and put the text between @" and "@ in it.Set-Content -Path SECDRV.cdf -Value @" [CatalogHeader] Name=SECDRV.cat PublicVersion=0x1 EncodingType=0x00010001 CATATTR1=0x10010001:OSAttr:2:6.0 [CatalogFiles] <hash>SECDRV=SECDRV.sys "@
- Make a driver catalog file in the folder.
makecat -o SECDRV.txt -r SECDRV.cdf
- Get the thumbprint of the certificate you created. The thumbprint is shown in
certlm
for the certificate created, just double click it and look around, without spaces. Or get it in PowerShell with dir:$Publishers = dir Cert:\LocalMachine -Recurse | where Subject -Match SECDRV | sort NotBefore $Publishers | select Thumbprint, NotBefore, NotAfter, Subject $Publisher = $Publishers | select -Last 1
- Sign the driver.
signtool sign /sm /s Root /sha1 "$($Publisher.Thumbprint)" /t http://timestamp.digicert.com secdrv.cat
- Install the driver. This adds it to the driver catalog on your system, but does not copy files or create driver services.
signtool catdb /u secdrv.cat
- Just to be sure, overwrite the
SECDRV.sys
on your system with the exact version that you signed and installed.copy .\SECDRV.sys "$env:windir\System32"
- Reboot.
- Test if it works.
sc.exe start secdrv
If it doesn't work, check these reasons.
- You are not an Administrator or you opened the PowerShell prompt without elevation. Right click the button in the Task Bar and hit Run as Administrator and start over.
SECDRV.sys
is too old. Then the driver doesn't start. Right click it, hit Properties, go to Details and check Product version. It contains a date as a string. If you downloaded it from the link above, the version is "SECURITY Driver 4.03.086 2006/09/13".- You might have to run games that need
SECDRV
as Administrator. The driver might not be installed and the driver services might not be present until you have tried this. - Secure Boot is enabled. Run
bcdedit
again after disabling it. - You didn't reboot. You will have to reboot.
Now play games.