# UPGDSED: removing PatchGuard and driver signature enforcement from Windows > UPGDSED is a C program that replaces the Windows boot files so the kernel stops enforcing driver signatures and PatchGuard, which lets an unsigned driver load on a modern x64 Windows. It suits people who need an unsigned driver to load and can restore the original files afterwards. **Fyyre/UPGDSED** — Universal PatchGuard and Driver Signature Enforcement Disable - Repository: https://github.com/Fyyre/UPGDSED - Stars: 891 · Forks: 262 - Language: C - License: MIT - Published: 2026-10-20 · Updated: 2026-10-20 · Language: en - Canonical page: https://hysenlabs.com/projects/fyyre-upgdsed ## What it replaces and why that matters The mechanism is a boot file substitution, and understanding it is the difference between using this responsibly and bricking a machine. The name expands to Universal PatchGuard and Driver Signature Enforcement Disable, and the topics listed for the repository name the mechanisms it turns off, namely PatchGuard, driver signature enforcement, kernel patch protection, and the Windows boot components involved, including the kernel itself and the bootloader. The uninstall procedure is the clearest description of what the tool does. In a command prompt running as administrator you delete the boot configuration entry that disables the guard, then you navigate to the Windows System32 folder and delete ntkrnlmp.exe, osloader.exe for BIOS boot or osloader.efi for EFI boot. So the program replaces the Windows kernel image and the boot loader with patched copies, and puts a boot configuration entry in place to make the patched versions load. PatchGuard is the kernel mechanism that checks the integrity of loaded drivers, and driver signature enforcement is the policy that only Microsoft-signed drivers load by default. Disabling both is what allows an unsigned driver to load, and it is also what removes a protection layer that exists for a reason. ## The supported Windows versions, and the two things you must change first The system requirements are explicit about the versions and about the two configuration changes that have to happen first. The target is x64 Windows across Windows 7 SP1, Windows 8, Windows 8.1, Windows 10 in its TH1, TH2, RS1, RS2 and RS3 releases, and Windows 11 in the 24H2, 25H2 and 26H2 releases. Administrator rights are required, and in case of EFI boot Secure Boot must be disabled. That Secure Boot requirement is a consequence of the method rather than an oversight, since the boot files are being replaced with copies that are not signed by the vendor, and a firmware-enforced signature check on those files will refuse to load them. The two prerequisites together define the use case, because a machine that has Secure Boot on, or that is managed by a policy that forbids turning it off, is not a candidate. The readme also states the general warning in the same terms for anyone considering it, that using the program might render the computer into an unbootable state. ## Install and uninstall are both short The operational steps are minimal, which is what makes the risk concentrated. To install, you run the program with administrator rights. To uninstall, in a command prompt running as administrator you delete the boot configuration entry that holds the disabled guard, and then you remove the patched files from the Windows System32 directory, deleting osloader.exe for a BIOS boot or osloader.efi for an EFI boot, along with the patched kernel file. The procedure is symmetrical with the install, which is the one piece of good news here, because the original files are not overwritten in place but replaced by named copies that you can delete. The source is provided as-is with the statement that it will be useful but without warranty of any kind, and that any use of the software is entirely at your own risk. The repository also ships a checksum file, UPGDSED.sha256, alongside a bin directory, which is the mechanism for confirming the built binary matches what was published, and it is worth checking before running an executable that modifies boot files. ## The project was dead for eight years and came back The status section carries the most interesting history in the repository, because it is edited in place rather than rewritten. The line saying the project was deprecated in 2018 with no further updates or plans available is struck through, and beneath it are two newer lines, one saying the project was resumed on September 23, 2026 and one saying the last update was September 25, 2026. So this is a two-day-old revival of a codebase that sat untouched for eight years, which is a very different risk profile from a maintained project. The testing statement is specific about what was actually verified, on a kernel version of 10.0.26100.9457 and a Winload version of 10.0.26100.9444. The release history matches the story, with v1.2.2 published on 2026-09-26 and before that v1.1.2 from 2017-07-28 and v1.0.0 from 2017-05-11, so the new release sits on top of a code base last touched in 2017. The two-day window between resuming and the last update is also why the testing note lists specific build numbers rather than a range of supported releases. ## The modern alternatives the readme points you at Rather than pretend the method is current, the readme points at three other projects for modern eloquent PatchGuard disable methods, in alphabetical order. EfiGuard is the first, then PgC, described in its link as garbage collecting PatchGuard, and then Shark. The framing of the sentence is worth noting, since the list of former methods is struck through with the note that if you still need to disable PatchGuard you should refer to those repositories, so the three named are the current ones and the earlier list is now the historical alternative. That matters because the historical methods relied on bootkits and on firmware-level tricks that Microsoft has progressively closed off, and the newer work is about doing it in a way that survives current builds. The references section lists the reading behind the original approach, starting with Skywing's paper on bypassing PatchGuard on Windows x64, then the author's own earlier write-ups for the lazy way and for the updated Windows 7 and 8 versions, a bootkit assembler archive, and then the general background on kernel patch protection and the Microsoft driver signing policy. If you are doing this, the Skywing paper is the piece that explains what is actually happening. ## Building from source, and what the repository contains The build requirements are old and simple. The project comes with full source code, and to build from source you need Microsoft Visual Studio 2015 or a later version. The repository layout is small, with a src directory holding the C sources, a bin directory for the built executable, the checksum file and the licence. There is also a separate repository linked from the references for a bootloader configuration file, and the older site repository referenced for the write-ups. The authors are listed as two people (from hfiref0x) and Fyyre, who is the author of the disable methods and the one behind the revival. The copyright line runs from 2017 to 2026, which matches the two periods of the project, and the licence is MIT, which is worth noting for anyone who wants to read the code and reimplement the approach, since the licence permits that and the operating system components involved are a separate question. ## Conclusion UPGDSED is a good fit for a driver developer with a legacy or internal unsigned driver that has to load on a current Windows build, and for anyone who needs to inspect what the kernel's integrity checks actually reject. It is the wrong tool if you simply want to load a signed driver, and it is the wrong tool if the machine is not one you can reinstall, because the readme warns plainly that using the program might render the computer into an unbootable state. Before running it, take a full image of the system partition, confirm the boot mode you have, since the uninstall procedure differs between BIOS and EFI, and check the tested versions against your build, because the project states it was tested on specific kernel and bootloader builds. The source is MIT licensed, the project was resumed in September 2026 after being deprecated in 2018, and the last push was on 2026-10-09. ## FAQ ### What does UPGDSED do to a Windows installation? It replaces the Windows boot files so the kernel stops enforcing driver signatures and PatchGuard, which lets an unsigned driver load. The uninstall procedure shows the mechanism, since you delete the boot configuration entry that disables the guard and then remove ntkrnlmp.exe along with osloader.exe for BIOS boot or osloader.efi for EFI boot from the System32 folder. ### Which Windows versions does UPGDSED support? x64 Windows, covering Windows 7 SP1, Windows 8, Windows 8.1, Windows 10 in the TH1, TH2, RS1, RS2 and RS3 releases, and Windows 11 in the 24H2, 25H2 and 26H2 releases. The project was tested on kernel version 10.0.26100.9457 and Winload version 10.0.26100.9444. ### What do I need before running UPGDSED? Administrative privilege is required, and in case of EFI boot Secure Boot must be disabled, because the boot files are replaced with copies the vendor has not signed. The readme also warns that using the program might render the computer into an unbootable state, and that any use is at your own risk. ### How do I uninstall UPGDSED? In a command prompt running as administrator, delete the boot configuration entry holding the patch guard disable entry, then go to the Windows System32 folder and delete ntkrnlmp.exe and osloader.exe for a BIOS boot or osloader.efi for an EFI boot. The procedure is the mirror image of the install, which is the reason to read it before you run anything. ### What are the current alternatives to UPGDSED? The readme points to three other projects for modern eloquent PatchGuard disable methods, EfiGuard, PgC and Shark, and the earlier list of methods is struck through with a note to refer to those repositories instead. The background reading includes Skywing's paper on bypassing PatchGuard on Windows x64, the author's own earlier bootloader write-ups, and the references on kernel patch protection and the driver signing policy. ## Sources - [Fyyre/UPGDSED on GitHub](https://github.com/Fyyre/UPGDSED) - [Issues](https://github.com/Fyyre/UPGDSED/issues) - [License: MIT](https://github.com/Fyyre/UPGDSED/blob/master/LICENSE) - [README](https://github.com/Fyyre/UPGDSED/blob/master/README.md) - [Releases](https://github.com/Fyyre/UPGDSED/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/fyyre-upgdsed