Can a third-party signed user-mode Audio Processing Object (APO) package be installed on Windows 11 with Secure Boot enabled?

Hello Microsoft Community,

I am developing SONVECT, a free and open-source audio processing application for Windows gamers.

We are investigating whether a Windows Audio Processing Object (APO) can be distributed without purchasing an Extended Validation (EV) certificate or submitting the package to the Microsoft Hardware Developer Program.

Our proposed architecture consists of:

• A user-mode APO DLL loaded by the Windows audio engine (audiodg.exe).

An extension INF (Class=Extension) targeting a specific USB audio device by hardware ID.

An APO component INF (Class=AudioProcessingObject on Windows 11, with the appropriate Windows 10 alternative).

Driver package catalog files (.cat) generated using Inf2Cat and signed with a trusted third-party Authenticode code-signing certificate.

The package contains no kernel-mode driver or .sys file.

We are considering SignPath Foundation, which offers free code signing for qualifying open-source projects.

Questions

1. Third-party signing and installation

Can such a user-mode APO driver package be installed locally through PnPUtil on Windows 10/11 x64 using a trusted third-party Authenticode signature, without Microsoft attestation or WHQL signing?

Would this installation be accepted with Secure Boot enabled?

2. Memory Integrity and protected audio

Would Memory Integrity (HVCI), Smart App Control, or the protected Windows audio process prevent installation or loading of this APO?

If the APO does not have Microsoft's PETrust signature attribute, what happens when protected media content is played?

3. Third-party hardware

Can an extension INF supplied by an independent software developer target the hardware ID of an audio device from another manufacturer, without being the original device manufacturer?

Are there restrictions on installing such an extension outside Windows Update?

4. Driver package requirements

Does the Microsoft requirement for signing production driver packages through the Hardware Developer Program apply to this user-mode-only APO configuration?

If third-party signing is supported, are there additional requirements for signing the INF catalog files, installing the APO component, or loading its DLL into audiodg.exe?

Intended environment

Windows 10/11 x64

Secure Boot enabled

Memory Integrity enabled where supported

No test-signing mode

No disabling Windows security features

Initial validation on a secondary USB audio device

Our project has no budget for paid driver certification, so we are trying to establish whether a fully compliant, freely signed, user-mode APO is technically feasible before proceeding.

We would greatly appreciate an authoritative clarification or links to the relevant Microsoft documentation.

Thank you for your help.

Best regards,

SONVECT ProjectHello Microsoft Community,

I am developing SONVECT, a free and open-source audio processing application for Windows gamers.

We are investigating whether a Windows Audio Processing Object (APO) can be distributed without purchasing an Extended Validation (EV) certificate or submitting the package to the Microsoft Hardware Developer Program.

Our proposed architecture consists of:

A user-mode APO DLL loaded by the Windows audio engine (audiodg.exe).

An extension INF (Class=Extension) targeting a specific USB audio device by hardware ID.

An APO component INF (Class=AudioProcessingObject on Windows 11, with the appropriate Windows 10 alternative).

Driver package catalog files (.cat) generated using Inf2Cat and signed with a trusted third-party Authenticode code-signing certificate.

The package contains no kernel-mode driver or .sys file.

We are considering SignPath Foundation, which offers free code signing for qualifying open-source projects.

Questions

1. Third-party signing and installation

Can such a user-mode APO driver package be installed locally through PnPUtil on Windows 10/11 x64 using a trusted third-party Authenticode signature, without Microsoft attestation or WHQL signing?

Would this installation be accepted with Secure Boot enabled?

2. Memory Integrity and protected audio

Would Memory Integrity (HVCI), Smart App Control, or the protected Windows audio process prevent installation or loading of this APO?

If the APO does not have Microsoft's PETrust signature attribute, what happens when protected media content is played?

3. Third-party hardware

Can an extension INF supplied by an independent software developer target the hardware ID of an audio device from another manufacturer, without being the original device manufacturer?

Are there restrictions on installing such an extension outside Windows Update?

4. Driver package requirements

Does the Microsoft requirement for signing production driver packages through the Hardware Developer Program apply to this user-mode-only APO configuration?

If third-party signing is supported, are there additional requirements for signing the INF catalog files, installing the APO component, or loading its DLL into audiodg.exe?

Intended environment

Windows 10/11 x64

Secure Boot enabled

Memory Integrity enabled where supported

No test-signing mode

No disabling Windows security features

Initial validation on a secondary USB audio device

Our project has no budget for paid driver certification, so we are trying to establish whether a fully compliant, freely signed, user-mode APO is technically feasible before proceeding.

We would greatly appreciate an authoritative clarification or links to the relevant Microsoft documentation.

Thank you for your help.

Best regards,

SONVECT Project