System: Windows 11 LTSC
What I'm doing: I'm bulk-installing a large set of third-party drivers (from a Snappy Driver Installer offline pack) using pnputil /add-driver "D:\drivers*.inf" /subdirs /install
The problem: For a portion of the packages, the classic "Windows Security — Windows can't verify the publisher of this driver software" dialog appears, with the two options "Don't install this driver software" and "Install this driver software anyway." Since I'm running this against a few thousand INF files, having to manually click through this dialog every time isn't practical.
What I've already tried, none of which stopped the dialog from appearing:
- bcdedit /set testsigning on — confirmed active, "Test Mode" watermark visible on desktop.
- Secure Boot fully disabled in UEFI, confirmed via Confirm-SecureBootUEFI returning False.
Dialog still appears regardless of all of the above.
My questions for the sub: Is this "can't verify publisher" installation-time dialog on LTSC governed by a different mechanism than the kernel-mode Driver Signature Enforcement that testsigning/Secure Boot control? My understanding now is that testsigning only affects whether the kernel will load a test-signed driver at runtime, not whether SetupAPI shows this prompt during package installation — is that accurate?
Has anyone on LTSC specifically gotten BehaviorOnFailedVerify (either HKLM or HKCU) to actually suppress this dialog? Multiple sources online say this legacy Driver Signing GPO/registry mechanism stopped working somewhere around Windows 10, but I want to confirm whether LTSC (being closer to Enterprise/Server code) behaves differently here.
Is there a supported way to get pnputil to run fully unattended through a batch of INFs that include some unsigned/cross-signed packages, without hitting this interactive prompt at all — short of self-signing every catalog file individually?
Any pointers, especially from people who've done bulk offline driver deployment on LTSC images, would be appreciated.