Error code 0xc0000428: how to fix “Windows cannot verify the digital signature”

Applies to: Windows 11 and Windows 10 PCs that stop at a blue or black recovery screen showing Error code: 0xc0000428.

What error 0xc0000428 means

The code is STATUS_INVALID_IMAGE_HASH. Before Windows loads, Boot Manager checks that each boot file and boot-start driver is signed and unchanged. If one fails the check, it stops and shows a screen like this:

File: \Windows\System32\winload.efi
Error code: 0xc0000428
Windows cannot verify the digital signature for this file.

Write down the file path. It tells you where to look:

File named	Likely cause	Best fix
winload.efi or winload.exe	Boot files out of step after a failed update, another boot loader, or an expired preview build	Fixes 2, 3 and 5, or the dual boot section
A driver in \System32\drivers\ (a .sys file)	An unsigned, damaged or outdated third-party driver	Fixes 1 and 4
No file listed	Damaged boot configuration or disk errors	Fixes 2 and 5

How to open the recovery options

All the fixes start in the Windows Recovery Environment (WinRE). If the error screen lists F8 for Startup Settings, press it and go straight to step 2 of Fix 1. Otherwise:

1. Turn the PC on and, as soon as the logo appears, hold the power button to turn it off. Do this twice; on the third start Windows opens Automatic Repair.
2. Select Advanced options to reach the Choose an option screen.
3. If that doesn’t appear, boot from a Windows 11 or 10 USB installer, choose your language and select Repair your computer.

If the drive is encrypted, WinRE may ask for your BitLocker recovery key before it opens a command prompt. See where to find a BitLocker recovery key (the steps work for any brand). If WinRE itself is missing, see the Windows RE image was not found.

Fix 1: Start once with driver signature enforcement off

1. In WinRE, go to Troubleshoot > Advanced options > Startup Settings and select Restart.
2. When the list appears, press 7 or F7 for Disable driver signature enforcement.
3. If Windows starts, uninstall or update the program or driver that owns the file from the error (see Fix 4), then restart normally.

This only lasts for one start, which is what you want. Don’t turn signature checks off permanently with bcdedit switches such as nointegritychecks: they don’t work while Secure Boot is on, and they leave the PC open to rootkits.

Fix 2: Run Startup Repair

In WinRE, select Troubleshoot > Advanced options > Startup Repair and pick your account. It checks the boot configuration and system files and fixes what it can. If it says it couldn’t repair the PC, continue with Fix 3.

Fix 3: Uninstall the latest update

If the error started right after Windows installed updates, go to Troubleshoot > Advanced options > Uninstall Updates. Try Uninstall latest quality update first, then Uninstall latest feature update if the PC recently moved to a new Windows version.

Fix 4: Remove the driver named in the error

If the file is a third-party driver (for example from antivirus, anti-cheat, VPN or old hardware software), you can move it aside from the WinRE command prompt. Open Troubleshoot > Advanced options > Command Prompt and find your Windows drive; it may not be C: in WinRE:

dir C:\Windows
dir D:\Windows

Then rename the driver, using the drive letter and file name from your error:

ren D:\Windows\System32\drivers\example.sys example.sys.old

Close the window and select Continue. Only do this for third-party drivers. If the file is a core Windows driver, use Fix 5 instead, because renaming it can stop Windows from starting at all. Once Windows starts, reinstall the latest version of the software the driver came from.

Fix 5: Rebuild the boot files

From the WinRE Command Prompt, repair system files and copy fresh boot files from the Windows folder (replace C: with your Windows drive):

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
bcdboot C:\Windows

bcdboot rewrites Boot Manager and the boot configuration on the system partition, which fixes most winload errors. If it reports a failure on a UEFI PC, run chkdsk C: /f to fix disk errors and try again.

Dual boot and expired preview builds

• After installing Linux or Android-x86: another boot loader may now start first. Open your PC’s UEFI settings, move Windows Boot Manager to the top of the boot order and leave Secure Boot on.
• Windows Insider or evaluation builds: preview builds carry an expiry date. Once it passes, Boot Manager can’t verify winload and the PC won’t start. There’s no repair; back up your files from WinRE or another PC and install a released version of Windows. See how to reinstall Windows.

Related guides

• The Windows RE image was not found: how to fix and re-enable WinRE
• Dell BitLocker recovery key: where to find it and why it appears
• Getting Windows ready, don’t turn off your computer: stuck? How to fix it
• How to reinstall Windows 10: reset, repair install or clean install

Official sources: for more detail, see Microsoft’s own pages:

• Microsoft Support: Windows startup settings
• Microsoft Learn: Boot error 0xC0000428 (status invalid image hash)

Frequently asked questions

Is 0xc0000428 a hardware failure?

Usually not. It’s a signature check failing on a file. A failing drive can corrupt files and cause it, so run chkdsk if the error keeps coming back.

Will these fixes delete my files?

No. Startup Repair, uninstalling updates, renaming a driver and rebuilding boot files don’t touch your personal files. Only a reinstall or reset can, and Reset this PC offers to keep them.

Why does pressing 7 work but the error returns on the next start?

Option 7 skips the signature check for that one start. The file is still unsigned or damaged, so remove or update it while Windows is running.

Should I turn off Secure Boot?

No. Secure Boot isn’t the cause, and turning it off doesn’t fix a damaged boot file. Keep it on and repair the file instead.