Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / How Windows 11 Is Forcing Enterprise Antivirus Recertification
Transcript
- Lucas: So I got a call last week from an IT director at a mid-size logistics firm. They've got about 3,000 endpoints, and their security vendor — I won't name them — sent out an urgent advisory saying their antivirus agent won't load on Windows 11 version 24H2 unless they update to a new build by October. Luna: Wait — the agent just doesn't load? Not a performance issue or a compatibility warning? Lucas: Nope. It flat out won't start. Because Microsoft has basically changed the rules for what kind of kernel-mode drivers are allowed. And any security software that relies on an old-style driver — even if it's been signed — gets blocked at boot. Luna: So this is tied to the whole kernel hardening push they started with Windows 11. I remember them talking about driver requirements years ago. Lucas: Exactly. Back in 2021, Microsoft announced they'd require all new kernel-mode drivers to be submitted to the Windows Hardware Developer Center and signed by Microsoft. But they grandfathered in a ton of existing drivers. Version 24H2 is effectively ending that grandfather period. If your security vendor hasn't recertified their driver under the new policy, Windows simply rejects it. Luna: And this affects more than just antivirus, right? Endpoint detection and response tools, host intrusion prevention — anything that hooks into the kernel. Lucas: Right. CrowdStrike, SentinelOne, Trend Micro, even Microsoft's own Defender for Endpoint had to go through recertification for their kernel drivers. Most of the big names have done it. But there are dozens of smaller security vendors — especially in verticals like healthcare or industrial control — that haven't. Luna: I've heard that some of these older drivers were basically a security hole. They had kernel-level access with minimal oversight. Lucas: That's exactly Microsoft's argument. The old driver signing process was more of a formality. You'd submit a driver, pay a fee, get a signature. Now they require actual attestation, code review, and compliance with the Security Development Lifecycle. It's a much higher bar. Luna: So what's the practical impact for an enterprise that's rolling out 24H2 right now? If their security vendor isn't ready, do they just delay the upgrade? Lucas: Many are delaying. But Microsoft has also made it harder to bypass. In earlier versions of Windows 11, you could enable a group policy to allow unsigned drivers. In 24H2, that policy is deprecated. So the only real workaround is to use a security product that's already certified. Luna: And if you're stuck on an older build, you're missing security patches. That's a tough spot. Lucas: Yeah. The IT director I talked to ended up doing an emergency migration to Microsoft Defender for Endpoint because their old vendor couldn't give a firm certification date. That's a huge decision — retraining the security team, reconfiguring policies, dealing with a different alerting system. Luna: And Defender for Endpoint is obviously Microsoft's own product, so it's certified by definition. But is it as good as the third-party alternatives? Lucas: It depends on your threat model. For basic antivirus and endpoint detection, Defender for Endpoint is solid. It's consistently near the top in independent tests, and it integrates deeply with Microsoft 365. But some organizations prefer the behavioral analysis or threat hunting features in CrowdStrike or SentinelOne. The point is, the recertification is forcing a reevaluation of the entire security stack. Luna: I've seen reports that some enterprises are using this as a chance to consolidate vendors. If you have to recertify anyway, why not standardize on one or two? Lucas: Exactly. And that's actually a smart strategy. But it's also risky if you move too fast and don't test the new agent thoroughly. I've heard of cases where the new driver conflicted with legacy line of business applications. Luna: So IT teams should be proactively checking their security vendor's certification status, not waiting for a pop-up warning. Lucas: Yes. And the certification isn't just a one-time thing. Microsoft is requiring that any driver updates — even minor ones — go through the same process. So vendors have to maintain continuous compliance. That's actually a good thing for security, but it means more overhead for the software vendor, and that cost eventually passes to the customer. Luna: Speaking of cost — I've heard some security vendors are using the recertification as a reason to push customers toward more expensive tiers. 'Oh, you want the driver that actually works on Windows 11? That's in our Enterprise plan.' Lucas: I've seen that too. It's a vendor lock-in play. But from Microsoft's perspective, they probably don't mind. Every enterprise that switches to Defender for Endpoint strengthens their ecosystem. And honestly, for many small and medium businesses, Defender is more than enough if they pair it with good security practices. Luna: So what's the timeline? When does the old driver support actually end? Lucas: Microsoft hasn't given a hard cutoff for every driver, but version 24H2, which started rolling out in late 2025, is the first release where the new requirement is enforced by default. Some enterprise editions have a grace period via group policy, but that grace period ends in October 2026. After that, any machine running 24H2 without a certified driver simply won't load the security agent. Luna: That's less than four months away. A lot of IT teams are probably not aware. Lucas: That's the scary part. I've talked to three IT managers this month who found out about this only when their pilot machines failed to boot properly after the update. One of them had to reimage a whole fleet. Luna: Yeah, this is exactly the kind of thing that makes IT directors lose sleep. Lucas: And that's actually a good segue. A lot of the listeners of this show are the people who have to deal with exactly these kinds of late-breaking surprises. And the reason we can keep this podcast ad-free — no sponsors, no sponsored segments, no 'this episode brought to you by' interruptions — is that some of those listeners choose to support us directly. If today's conversation saved you even a few minutes of research, or if you've ever used something from a past episode in your own work, you can head to buy me a coffee dot com slash fexingo. It's a small way to keep this show independent and focused on what actually matters for Windows in the enterprise. Luna: Absolutely. And it genuinely makes a difference. We don't have a huge team — it's basically just us and our editor. So every bit of support goes straight into research time and better episodes. Lucas: Right. So back to the recertification issue — one thing I want to highlight is that this isn't just about antivirus. Any software that uses a kernel driver is affected: backup tools, disk encryption, even some hardware monitoring utilities. Luna: So IT teams need to inventory all kernel drivers across their fleet and check certification status for each one. Lucas: Yes. And there are tools that can help. Microsoft's own Driver Verifier and the Hardware Dashboard can show which drivers are signed under the new policy. But the easiest first step is to contact your software vendors and ask for their certification status in writing. Luna: And if a vendor says they're working on it but don't have a date, what's the fallback? Lucas: You have a few options. You can delay the 24H2 rollout for those machines, but that's a security risk. You can switch to a certified product, like Defender for Endpoint or a third-party vendor that's already certified. Or you can use Windows 10, which still supports older drivers — but Windows 10 goes end of life in October 2028, so that's a temporary fix at best. Luna: It really feels like Microsoft is using technical requirements to enforce a security baseline. Which is good for the ecosystem, but painful in the short term. Lucas: Exactly. And I think that's the right call. Kernel-mode exploits have been a huge attack vector. By raising the bar on driver quality, Microsoft is making Windows more secure for everyone. But they could have communicated the timeline better. A lot of enterprises are caught off guard. Luna: So our recommendation: audit your drivers, check with vendors, and if you're on 24H2 already, verify your security agents are loading properly. Lucas: And if you find a problem, escalate now. Don't wait until October. The vendor certification queues are only going to get longer as the deadline approaches. Luna: Good advice. Thanks, Lucas.