How to Enable or Disable Microsoft Vulnerable Driver Blocklist in Windows 11
- 9 steps
- Needs administrator rights
- Includes a restart or sign-out
To enable the vulnerable driver blocklist in Windows 11, open Windows Security Device security Core isolation details and turn on the Microsoft Vulnerable Driver Blocklist switch. Turning it off uses the same switch. This guide covers both, plus what to check if a device stops working afterward.
The blocklist stops drivers that Microsoft has flagged as unsafe from loading, which protects your PC from malware that abuses them. You need an administrator account to change it.
To enable or disable the Microsoft Vulnerable Driver Blocklist, open Windows Security, navigate to Device security, select Core isolation details, and toggle the Microsoft Vulnerable Driver Blocklist switch. This setting requires administrator privileges.
What is the Microsoft Vulnerable Driver Blocklist?
The Microsoft Vulnerable Driver Blocklist is a Windows security feature. It holds a list of drivers known to be vulnerable or abused by attackers, and Windows refuses to load any driver on that list. Microsoft updates the list over time, so it grows as new problem drivers are found.
Why use this feature?
Drivers run with very high privileges in the Windows kernel. A single flawed driver can give an attacker a way past most of your other defenses. The blocklist closes that route by keeping drivers with known exploits, or with kernel-mode code signing problems, from running.
In practice this keeps the system more stable and makes it harder for someone to take control of your PC through a bad driver.
What happens when you change it?
While the blocklist is on, Windows checks drivers against its database of known vulnerable ones before it lets them load. A driver that matches is blocked.
If you turn the blocklist off, an old piece of hardware that depends on a blocked driver may start working again. The cost is a much higher risk of exploitation. I only recommend turning it off briefly, to confirm that the blocklist is what is breaking a specific device. Turn it back on once you have your answer, and look for an updated driver from the hardware maker.
How to Enable or Disable the Blocklist
You manage the blocklist from the Windows Security app. Sign in with an administrator account first. Windows may ask you to confirm with a User Account Control prompt.
- Click the Start button to open the Start menu.
- Type Windows Security and click the app in the results. The Windows Security window opens.
windows 11 search windows security app on start menu - Click Device security in the left sidebar. The page shows your device’s security features.
windows 11 security app device security option - Under Core isolation, click Core isolation details. The Core isolation page opens with its switches.
windows 11 core isolation details link - Find Microsoft Vulnerable Driver Blocklist and set the switch to On to enable it, or Off to disable it. Confirm the User Account Control prompt if one appears.
windows 11 microsoft vulnerable driver blocklist button - Restart your PC if Windows asks you to. The change may not fully apply until you do.
If the switch is greyed out or missing, your device may be managed by an organization’s policy, or your account may not be an administrator. Check with whoever manages the PC. To undo the change, follow the same steps and flip the switch back.
Technical Implementation and Troubleshooting
When the blocklist stops a driver, Windows records it. You can open Event Viewer to see which driver was blocked and why. The details help you decide whether to look for an updated driver or contact the hardware maker.
Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard
If a device stops working after you enable the blocklist, check the logs for the cause:
- Click Start, type Event Viewer, and open the app.
- In the left pane, go to Applications and Services Logs Microsoft Windows CodeIntegrity.
- Select the Operational log and look for recent warning or error entries that name the blocked driver file.
Note the driver file name and the time of the entry, then match it to the device that failed. An updated driver from the manufacturer usually fixes it. Only turn the blocklist off as a short test.
Summary
The Microsoft Vulnerable Driver Blocklist is an important security layer that keeps known bad drivers off your PC. Leave it on unless you are troubleshooting a specific hardware problem, and switch it back on afterward.
Have a question about this guide?
Answered by AI from this guide. Good questions may be added to this page — please don't include personal details.
Did this guide fix your problem?
About the Author
Richard
Tech Writer, IT Professional
Richard is a writer at Geek Rewind who turns complex IT tasks into clear, step-by-step guides. He draws on years of hands-on experience in system administration and enterprise IT operations, focusing on Windows, Linux and WordPress: the problems people actually run into, and the fixes that work. His server and WordPress guides come from systems he runs himself. Richard builds and maintains the platform behind Geek Rewind, from its Ubuntu servers and Nginx configuration to its custom WordPress plugins. Many new tutorials start with readers' questions, and he's always glad to answer them in the comments.
No comments yet — be the first to share your thoughts!