Post-CrowdStrike: Microsoft to Phase Out OEM Kernel-Level Driver Privileges

On 20 November 2025, security news outlet Daily CyberSecurity reports that Microsoft is establishing a new driver standard and plans to phase out OEM kernel-level privileges. The move follows years of driver-related failures, including the July 2024 global blue-screen outage triggered by a CrowdStrike driver.

According to Microsoft, all signed drivers will eventually need to meet stricter security and reliability standards and pass a new battery of certification tests, with kernel-mode code volume to be sharply reduced over the next several years. Vendors will be able to replace their custom kernel modules with Windows-native drivers, or migrate their logic to user mode, to keep core functions working while separating driver privileges from the kernel.

The article notes that Microsoft will still support third-party kernel-mode drivers where no standard option exists, and outlines safeguards such as mandatory compiler-level security constraints, driver isolation, and DMA remapping to limit crash impact. It also states kernel-space anti-cheat drivers are unlikely to be restricted, as game developers rely on them unless a standard alternative is provided.