Introduction

Different Windows versions have different kernel-mode signing options:

• Windows 7/8/8.1/Server 2012r2
  • Cross-signing
  • WHQL-certified (HCR)
• Windows 10 desktop
  • Attestation signing
  • WHQL-certified (HLK)
• Windows Server 2016/2019
  • WHQL-certified (HLK)

According to practical testing done by ​wintun developers it is possible to cover all Windows 10 platforms with the following HLK clients:

• Windows Server 2019 (64-bit)
• Windows Server 2019 core (64-bit)
• Windows 10 desktop (32-bit)

Wintun was able to pass HLK testing without any physical HLK clients. But due to its narrower scope it had to pass much fewer HLK tests (~50 in total) than tap-windows6.