= Introduction =

Different Windows versions have different kernel-mode signing options:

* Windows 7/8/8.1/Server 2012r2
 * Cross-signing
 * WHQL-certified (HCR)
* Windows 10 desktop
 * Attestation signing
 * WHQL-certified (HLK)
* Windows Server 2016/2019
 * WHQL-certified (HLK)

According to practical testing done by [https://www.wintun.net/ wintun] developers it is possible to cover all Windows 10 platforms with the following HLK setup:

* HLK controller: Windows Server 2016
* HLK clients
 * Windows Server 2019 (64-bit)
 * Windows Server 2019 core (64-bit)
 * Windows 10 desktop (32-bit)

Wintun was able to pass HLK testing without any physical HLK clients. But due to its narrower scope it had to pass much fewer HLK tests (~50 in total) than tap-windows6.

= HLK testing prerequisites =

* [https://docs.microsoft.com/en-us/windows-hardware/test/hlk/testref/lan-testing-prerequisites LAN testing prerequisites]

= External links =

* [https://github.com/Puppet-Finland/puppet-hlk/ puppet-hlk]: Puppet module for setting up HLK controllers and HLK clients
* [https://docs.microsoft.com/en-us/windows-hardware/test/hlk/getstarted/getstarted-vhlk Windows Virtual Hardware Lab Kit]