How to Use the sigverif Tool in Windows 11 to Scan and Identify Unsigned Device Drivers

Windows 11 enforces Driver Signature Enforcement (DSE) at the kernel level to prevent rootkits, compromised hardware binaries, and unstable kernel extensions from compromising operating system integrity. However, legacy enterprise peripherals, specialized hardware utilities, or software that bypasses signing checks during development can sometimes leave unsigned or altered drivers on disk. These unsigned binaries are a frequent root cause of unexpected Blue Screen of Death (BSOD) stop codes, sleep state crashes, and hardware driver conflicts.

To audit driver integrity without purchasing third-party diagnostic software, Windows includes a native utility: the File Signature Verification tool (sigverif).

What is the sigverif Utility?

The sigverif.exe executable is a native component of Windows that systematically scans all files located within the critical system directories (specifically C:\Windows\System32\drivers). It queries the Windows Catalog database and digital certificate stores to verify whether each driver has been cryptographically signed by Microsoft or an authorized Hardware Quality Labs (WHQL) vendor.

Upon completing its scan, the tool generates a clean, plain-text audit report (SIGVERIF.TXT) listing every binary that lacks a valid digital signature.

When to Run File Signature Verification

Executing sigverif is recommended under several troubleshooting scenarios:

• Post-Crash Diagnostics: When diagnosing kernel panic minidumps referencing SYSTEM_THREAD_EXCEPTION_NOT_HANDLED or DRIVER_IRQL_NOT_LESS_OR_EQUAL.
• Enterprise Security Auditing: Prior to deploying endpoint hardening policies or activating Virtualization-based Security (VBS) and Hypervisor-protected Code Integrity (HVCI).
• Hardware Upgrades: After connecting legacy diagnostic equipment, specialized CNC controllers, or USB interface adapters that require manual driver installations.

Step-by-Step: Running a Driver Scan with sigverif

1. Press Win + R to open the Run dialogue box.
2. Type sigverif and press Enter (or click OK). Administrative elevation may be requested.
3. In the File Signature Verification dialogue window, click Advanced to review scan settings:
   • Under the Search tab, confirm that “Look for other files that are not digitally signed” is selected.
   • Under the Logging tab, verify that “Save the file signature verification results to a log file” is checked, and note the default log name (SIGVERIF.TXT).
4. Click OK to return to the main window.
5. Click Start to initiate the scan. Windows will examine hundreds of driver files in real time.

Interpreting Scan Results and Audit Logs

When the scan finishes, Windows displays one of two outcomes:

Scan Outcome	Dialog Message	Recommended Action
All Drivers Signed	“Your files have been scanned and verified as digitally signed.”	No action required; your kernel driver ecosystem conforms to Microsoft WHQL standards.
Unsigned Drivers Found	A tabular list of unsigned files appears directly in the dialogue.	Inspect individual file paths, investigate vendor legitimacy, and update or replace the affected driver packages.

Accessing the Detailed SIGVERIF.TXT Log

To inspect full technical details, open the generated log report in Notepad:

notepad C:\Users\Public\Documents\SIGVERIF.TXT

Each entry records the file status, date modified, file version, and file description:

Status        File                 Version        Date
-------------------------------------------------------------------
Not signed    vjoy.sys             2.1.9.1        14/03/2022
Not signed    cpuz154_x64.sys      1.54.0.0       22/08/2021

Remediating Unsigned Drivers

If suspicious or outdated unsigned drivers are detected:

• Check the Vendor Website: Visit the official hardware manufacturer portal to download the latest WHQL-certified driver package.
• Remove Obsolete Drivers via pnputil: Open Terminal as Administrator and execute pnputil /enum-drivers to locate the published driver name (e.g., oem24.inf), then purge it using pnputil /delete-driver oem24.inf /uninstall /force.

Frequently Asked Questions

Does sigverif automatically delete or quarantine unsigned drivers?

No. sigverif is strictly a diagnostic and reporting tool. It does not delete files, alter registry entries, or disable drivers automatically.

Can unsigned drivers run in Windows 11 if Secure Boot is enabled?

In Windows 11 with default security settings and Secure Boot active, the kernel blocks unsigned drivers from loading into memory. Unsigned drivers usually only execute if Driver Signature Enforcement has been manually suppressed via Advanced Startup options.