FYI: DISM 10 skips signature on Windows 7

[Tripredacus]

Saw this today, working with making WinPE v"whatever" using the Windows 10 ADK. If running on a Windows 7 SP1 x64 host, DISM will skip driver signature enforcement when servicing a newer WinPE equivalent image.

 

 

This is helpful and not at the same time. I think for a WinPE, it isn't a big deal but it would be for an OS. Using DISM from Win8/8.1 ADK, you'd get a certificate error when trying to inject a driver signed by the WDK for 8/8.1 if the host PC was Win7 or Server 2012 SP2. It wasn't an error per-se, but basically the host was not able to interpret the certificate on a digitally signed driver and thus threw the error. If you did the injection on a Win8/2012 R2 host, there would be no problem.

 

I am just doing testing now, so I hope that this doesn't happen on a 2012 host because I don't really want to build a VM with Win10 or 8.1 just to inject digitally signed drivers into OS images. Note: the reason this is an issue is certain channels are unable to disable signature enforcement on OS images.

[noelblanc]

Hello,

Thanks for this information.

 

Please, may i ask you if you try to inject a  "MS's" driver with regedit. I want to inject the nativewifip.sys but i can't do this with dism ( no inf file !) . And i don't find the .cat in the catroot of install.Wim (w10).

Do you know how to do with the .cat?

 

Note : I try to inject http.sys with regedit and the copy of the good "cat" files of http. And it's ok when winpe10 start.

 

Thank you very much

 

[Tripredacus]

I have not done anything like that before, only putting .sys files in System32 of the mounted image.