Enable or Disable Microsoft Vulnerable Driver Blocklist in Windows 11

Starting with Windows 10 (KB5018482) and Windows 11 (KB5018483 and KB5018496), the Microsoft Vulnerable Driver Blocklist is enabled by default.

The vulnerable driver blocklist is also enforced when either memory integrity (also known as hypervisor-protected code integrity or HVCI), Smart App Control, or S mode is active. Users can opt in to HVCI using the Windows Security app, and HVCI is on by-default for most new Windows 11 devices.

The vulnerable driver blocklist is designed to help harden systems against third party-developed drivers across the Windows ecosystem with any of the following attributes:

Known security vulnerabilities that can be exploited by attackers to elevate privileges in the Windows kernel
Malicious behaviors (malware) or certificates used to sign malware
Behaviors that aren’t malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel

This tutorial will show you how to turn on or off the Microsoft Vulnerable Driver Blocklist for all users in Windows 10 and Windows 11.