How to Install Unsigned Drivers easily on Windows 10/11?

What should we do when installing unsigned drivers?

To begin, let's gather the tools we need. Most of these are sourced from the Windows Driver Kit (Latest version: Windows Driver Kit W11 22H2):

• Inf2Cat.exe - For generating the unsigned catalog file from our INF
• MakeCert.exe - Used to create our certificate
• SignTool.Exe - To sign our catalog file with an Authenticode digital signature
• Certmgr.exe - To add and delete our certificate from the system root

Now, let's have a look at the steps you should follow to get your unsigned certificates installed silently.

How to Create a digital certificate by using the MakeCert tool?

A digital certificate is an electronic document that guarantees the identity of a website or an individual. It's a necessity for installing unsigned drivers as it creates an aura of trustworthiness.

Now, we’ll focus on creating a self-signed digital certificate using the MakeCert tool from the Windows Driver Kit.

For this process, we will be using an x86/x64 Free Build Environment command prompt with administrator permissions.

This task might sound daunting, but we have broken it down into simple steps for you. So let's jump right into it:

1. On the Start menu, right-click x86 Free Build Environment and select Run as administrator.

2. At the x86/x64 Free Build Environment command prompt, type the following command on a single line (it appears here on multiple lines for clarity and to fit space limitations):

makecert -r -n "CN=Name"
		 -ss CertStore
		 -sr LocalMachine

Ex: makecert -r -n CN="TestCert" -ss Root -sr LocalMachine

Let's break down what each parameter represents:

- -r: Specifies that the certificate is to be "self-signed," rather than signed by a CA. Also called a "root" certificate.

- -n "CN=Name": Specifies the name associated with this new certificate. It is recommended that you use a certificate name that clearly identifies the certificate and its purpose.

- -ss CertStore: Specifies the name of the certificate store in which the new certificate is placed.

- -sr LocalMachine: Specifies that the certificate store created by the -ss option is in the per computer store, instead of the default per user store.

3.The command returns the message "Succeeded" when the store and certificate are created.

How to Manually Exporting the Certificate from Certstore

Next, export the certificate manually by:

1. Run the administrator command: certmgr.exe
2. Right-click on your certificate, then select All Tasks → Export…
   

Install the certificate to Root and TrustedPublisher

With your certificate ready, install it to Root and TrustedPublisher using the 'certutil.exe' command:

certutil.exe -addstore "Root" [PathToCertificatewithFile]
certutil.exe -addstore "TrustedPublisher" [PathToCertificatewithFile]

To remove it, you can use this command:

certutil.exe -delstore "Root" [PathToCertificatewithFile]
certutil.exe -delstore "TrustedPublisher" [PathToCertificatewithFile]

Now we can install the driver without the prompt.

How to Build the MSI to Install Unsigned Drivers?

Now that we know how to sign a driver, let's focus on integrating these actions into an MSI. It takes two steps:

1. Install the certificate
2. Install the driver

For the second step, we already have an article that explains how to install drivers in multiple ways.

Now, we'll focus on crafting a script that executes the 'certutil' commands mentioned earlier.

Let’s assume that the driver .inf name is HP.inf and that we are going to place the certificate directly into the C:\Windows\DPInst.

For VBScript:

Option Explicit
On Error Resume Next
Dim strCmd,WshShell,strInstalldir
Set WshShell = CreateObject("WScript.Shell")
strInstalldir = WshShell.ExpandEnvironmentStrings( "%SYSTEMROOT%" )
strCmd = "certutil.exe -addstore " & chr(34) & "Root" & chr(34) & " " & chr(34) & strInstalldir & "\DPInst\TestCer.cer" & chr(34)
WshShell.Run strCmd

Once the script is created, navigate to the Custom Actions Page and add the Launch attached file predefined custom action into the sequence, select the installation vbscript file that was previously created and configure the Custom Action as such:

Make sure that the script which installs the certificate is placed before the script that installs the driver under the “Install Execution Stage” section.

It's even easier if you use PowerShell, since we can use the Import-Certificate cmdlet:

$CerLocation = $env:SystemRoot + "\DPInst\TestCer.cer"
Import-Certificate -FilePath $CerLocation -CertStoreLocation Cert:\LocalMachine\Root
Import-Certificate -FilePath $CerLocation -CertStoreLocation Cert:\LocalMachine\TrustedPublisher

Once we have the script ready:

1. Navigate to the Custom Actions Page and add the Run PowerShell script file predefined custom action into the sequence,

2. Select Attached Script

3. Choose the file that was previously created and configure the Custom Action as seen in the image below:

4. Next, build the package. During installation/uninstallation, the PowerShell scripts will run and install/uninstall the driver without asking if we want to install an unsigned driver.

Installing unsigned drivers with Advanced Installer

As you can see, handling unsigned certificates is time consuming and complicated.

Advanced Installer allows you to install unsigned drivers with just a few clicks:

1. Navigate to the Drivers page and click on New Driver.

2. Select the .inf file which must be present in the package.

3. Click on “Install unsigned driver packages and driver packages that have missing files” and let Advanced Installer take care of the rest.

That is it! Now, just build and install the package and you should have a clean installation without any warning messages from the OS.

Conclusion

Installing unsigned drivers can be a daunting task for IT professionals. A seemingly straightforward process can quickly become complex and time-consuming.

However, with the right tools and the tips provided in this guide, you can navigate this challenge with confidence and efficiency. Remember, your ultimate goal is to ensure a seamless and user-friendly installation process.

Good luck!