hi,
just had the same problem and found a solution.
english is not my first language so i let ai write the text.
Fixing a Blocked Hytera DMR USB Driver on Windows 11 (25H2)
Symptom
- Device Manager shows DMR Radio with a yellow warning under USB controllers.
- Windows Security pops: "This driver has been blocked — bkrwbus.sys does not meet the Windows Driver Policy."
- Kernel-PnP event 411: driver bkrwbus, Problem 0x27 (Code 39), status 0xC0E90002.
Root cause
The Hytera "Digital USB Driver" (bkrwbus.sys, 2013, MCCI cross-signed, no WHCP) is blocked by the
Windows Driver Policy. The April 2026 security update removed default trust for legacy cross-signed kernel drivers. The policy starts in audit/evaluation mode and auto-promotes to enforcement after enough uptime and reboots, so a driver that worked before can suddenly be blocked. There is no per-driver exception — either the publisher ships a WHCP-signed driver (Hytera does not), or you disable the policy.
The policy is enforced by two signed CI policy files:
- Enforce: {8F9CB695-5D48-48D6-A329-7202B44607E3}.cip
- Audit: {784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip
They can live in two locations:
- EFI System Partition: \EFI\Microsoft\Boot\CIPolicies\Active\
- Windows: %windir%\System32\CodeIntegrity\CiPolicies\Active\
Prerequisites
- Confirm Secure Boot state. (Disabling Secure Boot is required by Microsoft's procedure; if it is already off, skip the Secure Boot steps.)
- If BitLocker / device encryption is on, have the recovery key ready before touching Secure Boot. Check: manage-bde -status
Fix
1. (Only if Secure Boot is ON) Disable Secure Boot
Settings → System → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → UEFI Firmware Settings → set Secure Boot to
Disabled → save.
2. Delete the policy files from the EFI partition
Run
PowerShell as Administrator:
mountvol S: /s
cd S:\EFI\Microsoft\Boot\CIPolicies\Active
ls *.cip
# delete only the Windows Driver Policy GUIDs if present:
del ".\{8F9CB695-5D48-48D6-A329-7202B44607E3}.cip"
del ".\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip"
cd C:\
mountvol S: /d
Leave every other .cip (e.g. 5DAC656C, 82443E1E, CDD5CB55) untouched — those are standard system policies. "File not found" for a GUID just means it is not in this location.
3. Delete the policy files from System32 (needs ownership)
These files belong to TrustedInstaller, so Administrators get "Access denied" until you take ownership:
cd C:\Windows\System32\CodeIntegrity\CiPolicies\Active
ls *.cip
# for each Windows Driver Policy GUID present here (commonly the Audit one):
takeown /f ".\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip"
icacls ".\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip" /grant "*S-1-5-32-544:F"
del ".\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip"
*S-1-5-32-544 is the built-in Administrators SID (language-independent). Again, only the 8F9CB695 / 784C4414 files — leave all others.
4. Reboot
Mandatory. The policy stays loaded in the running kernel until the next boot.
5. Verify and connect
citool -lp | findstr /i "8f9cb695 784c4414"
Empty output = the Windows Driver Policy is no longer active. Then:
- Plug in the radio. Device Manager → DMR Radio should have no warning.
- A Digital/DMR COM port appears under Ports (COM & LPT) — note the number.
- Open the CPS, select that COM port, connect.
6. (Only if you disabled it) Re-enable Secure Boot
Re-enable in UEFI to keep the remaining Secure Boot protections.
Notes
- This lowers kernel-driver protection system-wide, not just for the radio. Security tradeoff is yours to accept.
- The policy can be re-applied by a future security update and can re-promote to enforcement after enough uptime/reboots. If it returns, repeat the deletion.
- Quieter long-term alternative for occasional codeplug work: program from a VM or a secondary machine without the April 2026 update / enforcement, using USB passthrough.
