= Introduction =

Microsoft has some documentation about HLK testing and WHQL signing, but it is quite incomplete, and there is lots of room for speculation and anecdotes. Practical testing is often required to understand the requirements fully. Therefore some of the requirements documented in this article are bound to change.

Different Windows versions have different kernel-mode signing options:

* Windows 7/8/8.1/Server 2012r2
 * Cross-signing
 * WHQL-certified (HCR)
* Windows 10 desktop
 * Attestation signing
 * WHQL-certified (HLK)
* Windows Server 2016/2019
 * WHQL-certified (HLK)

In this article we focus on HLK testing, which allows getting a WHQL signature for a kernel-mode driver. This is the only way to make a driver load on Windows Server 2016 and later.

= HLK testing environment =

HLK testing always requires a HLK !Controller/Studio node, plus one or more HLK clients.

According to practical testing done by [https://www.wintun.net/ wintun] developers it is possible to get a code signature that is valid for all Windows 10 platforms using the following HLK clients:

* HLK controller: Windows Server 2016
* HLK clients
 * Windows Server 2019 (64-bit)
 * Windows Server 2019 core (64-bit)
 * Windows 10 desktop (32-bit)

Wintun was able to pass HLK testing without any ''physical'' HLK clients. But due to wintun's narrower scope it had to pass much fewer HLK tests (~50 in total) than tap-windows6.

For tap-windows6 testing a couple of extra nodes are needed:

* OpenVPN server
* Support machine: required by some of the HLK tests

There are some additional requirements for tap-windows6 that stem from generic [https://docs.microsoft.com/en-us/windows-hardware/test/hlk/testref/lan-testing-prerequisites LAN testing prerequisites]:

* HLK client needs at least 4 virtual processor cores (unverified)
* HLK client need to be physical computers, not virtualized (unverified) 

= External links =

* [https://github.com/Puppet-Finland/puppet-hlk/ puppet-hlk]: Puppet module for setting up HLK controllers and HLK clients
* [https://docs.microsoft.com/en-us/windows-hardware/test/hlk/getstarted/getstarted-vhlk Windows Virtual Hardware Lab Kit]
* [https://aka.ms/HLKPlaylist] Compatibility Play Lists (Understanding is these are the only ones necessary to get signed)