USB serial COM ports disappearing on Windows 10 IoT after cumulative update

This issue may be caused by the Windows cross-signed driver trust policy change introduced in the April 2026 Windows security updates.

Background

Microsoft announced on March 26, 2026 that trust for all kernel drivers signed under the deprecated cross-signed root program would be removed. This program was deprecated in 2021 and all certificates have since expired. Starting with the April 2026 update, Windows now blocks these drivers at the kernel level with no audit grace period - meaning affected devices stop working immediately with no warning.

Reference: https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-driver-security-removing-trust-for-the-cross-signed-driver-pro/4504818

Why COM port drivers are affected

Virtual COM port drivers were commonly signed under the cross-signed program using SHA-1 certificates that expired many years ago. Windows previously tolerated these.

How to confirm this is your issue

Check the CodeIntegrity > Operational event log for Event ID 3004 referencing your driver file:

Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" -ErrorAction SilentlyContinue |

Where-Object { $_.Id -eq 3004 } |

Select-Object -Property TimeCreated, Id, Message |

Sort-Object -Property TimeCreated -Descending |

Format-List

If your driver appears in the results, this is your issue.

You can also inspect the driver signature directly. Note that Get-AuthenticodeSignature may return Status=Valid for timestamped drivers even when the certificate has long expired - you must inspect the certificate properties directly:

$sig = Get-AuthenticodeSignature -FilePath "C:\Windows\System32\drivers\YOURDRIVER.sys"

Write-Host "Algorithm : $($sig.SignerCertificate.SignatureAlgorithm.FriendlyName)"

Write-Host "Valid To : $($sig.SignerCertificate.NotAfter)"

Write-Host "Subject : $($sig.SignerCertificate.Subject)"

If Algorithm is sha1RSA and Valid To is years in the past, your driver is affected.

Remediation

The only permanent fix is an updated driver signed through the Microsoft Windows Hardware Compatibility Program (WHCP). Contact your hardware vendor. If the hardware is old and the vendor no longer supports it, replacement with hardware that has a current WHCP-signed driver is the recommended path.

Temporary workaround: On machines where Secure Boot is disabled, bcdedit /set testsigning on will bypass enforcement for one session. On Secure Boot-enabled machines, pressing F7 at boot provides a single-session bypass while you pursue a permanent fix.

Hello Dephile George,

USB‑to‑Serial COM ports often disappear after Windows 10 IoT cumulative updates because the update replaces manufacturer drivers with generic ones and resets PNP enumeration or USB power policies. This can cause COM port numbers to shift or the bridge chip to power down.

To fix this issue, set ExcludeWUDriversInQualityUpdate = 1 under HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate to stop Windows Update from overwriting your drivers. Then reinstall the certified driver from your hardware vendor and, in Device Manager, uncheck “Allow the computer to turn off this device to save power” for both the USB Serial Converter and the USB Root Hub.

I hope the response provided some helpful insight. If it clarified the issue for you, please consider marking it as Accept Answer so others with the same issue can find the solution. Feel free to leave a comment if you need further information.

Tracy.