Recovering from Windows 10 boot Blue Screen, Critical Service Failed, Disable drivers signature enforcement, Unsigned Drivers

In case it helps someone, worked for me in a recent very annoying BSOD in my Windows 10
(instead of a full refresh or fresh install, don’t settle easily for that, usually try to dig a little bit and see what I can find…).

*update 2017-05-19, found this thread on reddit with a safer fix/workaround: seems installing the new Windows creators update fixes the issue, so would advise for that first!*

*update 2017-05-19, please read the part II for additional info and possible issue with Disk Cleanup tool: Disk Cleanup and Windows 10 boot Blue Screen / Critical Service Failed – Disable drivers signature enforcement, Unsigned Drivers *

Please note: It’s been stable and no problem with restarts for a few days now, but not saying it’s a permanent fix or better than a clean install. Will update if something changes. (probably something on my system is triggering this and will happen again)

My advice also before testing any kind of changes or emergency repairs, keep calm, don’t make it worst, backup the data you want safe before anything else.

My setup

• Dual boot, default Win10 enterprise and an old Win81 legacy boot partition I still use occasionally
  (ex: when I get a recurring Blue Screen on boot !), no bitlocker
• Separated Data drive, with bitlocker
• Win10 Build 14393.1066 Version 1607
• Single SSD, 3 main partitions

Symptoms

• On restart and before my dual boot selection screen I get the Blue Screen,
  detail message is Critical Service Failed
• 
• Suspect this usually happens after major updates, I have the bad habit of never restart and always hibernate…
• The system is bootable if you choose the “Disable drivers signature enforcement” on the troubleshoot / AdvancedOptions / Startup settings screens (usually option 7 when you restart)
• 
• After restart with “Disable drivers signature enforcement” windows works pretty much as normal
• But every restart you will get the same Blue Screen as this option is not permanent (nor advised), and I end up having to do two restarts to enable the option again, better than nothing but annoying
• Running sigverif  tool (after booting with  “Disable drivers signature enforcement” to get Windows working) showed a huge number of “not signed” drivers??
• 
• in Event log (Application and Services Logs > Microsoft > Windows > CodeIntegrity > Operational I see a lot of errors when windows tries to load driver signature files needed, seems suddenly all drivers are being marked as not signed and Windows won’t allow it, except for enabling the “Disable drivers signature enforcement” boot option, also errors pointing to files I don’t have in C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
• 
• Drivers then get marked as not signed! not good…
• 
• When compared to similar setup from another win10 same build, the number of files on my C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} is very low (~1600 vs ~6000 files in the working win10), only two files starting with M… on my folder?
• 

What worked for me (use as is, as a last resource, no guarantees whatsoever, do your backups!):

After checking my win 10 build, got a zip with all the files in C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} from a “healthy and compatible donor” (thx António) and pasted the missing ones on my system. Being cautious not to overwrite any file just in case and doing a backup of my folder (obviously!).

check the build numbers, *probably* they should match your win build version, ex 14393

Restart, now the boot selection appears, choose win10, everything working. sigverif tool now only complains about few files that seem not critical, previous Eventlog CodeIntegrity errors also clear.

Now, what I really have a hard time to accept is why do we contribute with so much data, diagnostic & logging information these days, and still no sign of minor “windows data intelligence” suggestions to help with a problem that for sure I’m not the only to experience…

Thx also to Pedro Sousa and José António Silva and our Help Desk for their tips & guidance.

Yet again I skipped that clean install!  

Some references with similar problems

Critical_service_failed BSOD restart loop windows 10

All System32 drivers are suddenly unsigned in Windows 10

(Which reminds that one of these days I probably should share some thoughts on bitlocker, efs and …backups, do your backups! and be sure to test them!)

Rui