Boot-Start Driver Initialization Policy
This policy value determines which boot-start drivers Windows initializes after they have been evaluated by an Early Launch Antimalware (ELAM) driver.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\System\CurrentControlSet\Policies\EarlyLaunch\DriverLoadPolicy
This policy value determines which boot-start drivers Windows initializes after they have been evaluated by an Early Launch Antimalware (ELAM) driver. ELAM runs before other boot-start drivers and classifies each one as Good, Unknown, Bad but Boot Critical, or Bad.
The defined DriverLoadPolicy data values have the following meanings:
0x0(0): Initializes only drivers classified as Good.0x1(1): Initializes Good and Unknown drivers.0x3(3): Initializes Good, Unknown, and Bad but Boot Critical drivers. This is the documented default behavior.0x7(7): Initializes all boot-start drivers, including drivers classified as Bad.
If the policy is absent or disabled, Windows initializes Good, Unknown, and Bad but Boot Critical drivers. Bad drivers that are not boot-critical are skipped.
Notes
Additional effects
Winload includes the selected initialization policy in boot attestation measurements. The policy therefore affects both driver initialization and the measured representation of the system's boot state.
Security
More restrictive values reduce the number of untrusted drivers whose code can run in kernel mode during early startup. In particular, 0x0 also prevents drivers classified as Unknown from being initialized.
0x7 effectively removes the blocking decision provided by ELAM classification because even boot-start drivers identified as malware can be initialized. 0x3 permits such a driver only when ELAM also classifies it as necessary for the computer to boot successfully. This retains a security exposure but limits it to the boot-critical case.
Possible side effects
Excluding Unknown or boot-critical drivers can make required hardware or low-level software unavailable during startup. If a skipped driver is essential to the boot process, Windows might fail to start. After skipping a driver, the kernel continues attempting to initialize the remaining boot-start drivers unless the missing dependency prevents a successful boot.
Notes
The policy takes effect at the next system startup. It also depends on an active ELAM boot-start driver supplied by the antimalware product. If no ELAM driver is present or the driver is disabled, the policy has no effect and Windows initializes all boot-start drivers.
Microsoft documents the ADMX-backed policy value covered here under HKLM\System\CurrentControlSet\Policies\EarlyLaunch. The ELAM driver reference separately documents the operational policy location HKLM\System\CurrentControlSet\Control\EarlyLaunch. These two documented registry locations should not be treated as freely interchangeable values.
Microsoft documentation
Microsoft Learn: System Policy CSP – BootStartDriverInitialization
Microsoft Learn: ELAM Driver Requirements