My Hyper‑V host crashes after enforcing WDAC policy. How can I restore boot access ?

Question

My Hyper‑V host crashes after enforcing WDAC policy. How can I restore boot access ?

Syaheko Firman 20

All of my Hyper‑V hosts are configured with a strict WDAC code integrity policy in Enforcement Mode. However, once deployed, the hosts crash during boot with STOP 0x0000003B (SYSTEM_SERVICE_EXCEPTION). I have confirmed that a critical storage controller driver fails code integrity validation, preventing the system from loading properly.

I have not modified any drivers manually, nor have I installed unsigned components on these machines. Despite that, the enforcement policy blocks the driver required for storage initialization, leaving the host unable to boot.

When I attempt recovery, the system fails before reaching the OS, so I cannot disable WDAC from within Windows. I need to know how to sign or edit WDAC policies via Windows PE to restore boot capabilities without compromising integrity enforcement across the cluster.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello,

The STOP 0x0000003B you’re hitting is a direct result of WDAC enforcement blocking a boot‑critical driver. Since the host fails before the OS loads, you cannot disable WDAC from within Windows, so the only viable path is to adjust the policy offline from Windows PE.

You’ll need to mount the EFI System Partition and the OS volume from WinPE, then locate the WDAC policy files. By default, WDAC policies are stored under C:\Windows\System32\CodeIntegrity\SIPolicy.p7b. In Enforcement Mode, the system will refuse to load any driver not explicitly allowed in that policy. Because your storage controller driver is being blocked, you must either re‑sign the driver with a certificate trusted by the WDAC policy or edit the policy itself to include the driver’s publisher or file hash.

From WinPE, use certutil -addstore "TrustedPublisher" <certificate.cer> if you have the driver’s signing certificate available and trusted across the cluster. If not, the safer option is to regenerate the WDAC policy with an additional rule allowing that driver. On a separate management system, run New-CIPolicy with the -FilePath parameter pointing to the driver’s INF or binary, then merge it into your existing policy with Merge-CIPolicy. Once you have the updated .xml, convert it back to .p7b using ConvertFrom-CIPolicy and replace the existing SIPolicy.p7b in System32\CodeIntegrity on the affected host.

After replacing the policy file, reboot the host. The driver should now pass code integrity validation, allowing the storage stack to initialize. This preserves Enforcement Mode across the cluster while ensuring the boot‑critical driver is whitelisted. Do not attempt to disable WDAC entirely, as that would compromise the integrity baseline you’ve established.

If you don’t have access to the driver’s certificate or cannot regenerate the policy safely, the only supported fallback is to temporarily boot into WinPE, rename or remove SIPolicy.p7b to disable WDAC, bring the host up, and then redeploy a corrected policy cluster‑wide. Microsoft does not provide a way to bypass WDAC enforcement without either removing the policy or properly signing/whitelisting the driver.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.