"[EAC] cannot run if Drive Signature Enforcement has been disabled."

Hi, everyone.

I recently tried playing Rust again, and am getting the message “Rust Launcher Error: LauncherFailure - EasyAntiCheat cannot run if Driver Signature Enforcement has been disabled.”

I bought this laptop refurbished and w/o an OS from some company, so I installed Windows 7 on it (it would have come w/ Windows 8 otherwise, but I hate Windows 8.) Also, it is a UEFI install w/ dual-boot Ubuntu, so not only does grub handle all the boot-loading, but all the boot files are stored on a separate partition about 100MB in size (that is: even if all of my drivers were native Windows 8 drivers and I was running Windows 8, BCDEDIT doesn’t work for multiple reasons, so I wouldn’t be able to toggle DSE anyway).

Is there some kind of workaround or something I’m missing? It’d really be shit if I couldn’t play Rust because EAC requires me to alter everything about how my whole computer runs.

EAC requires Windows’ security model to remain intact – is this really such an onerous requirement? And, no, there is no workaround to allow you to continue to run unsigned drivers while also running EAC – unsigned drivers are how you get kernel-mode hacks into a rootkit position where EAC can’t see them.

Pretty much. VAC does the same thing too.

“EAC requires Windows’ security model to remain intact” is a vacuous requirement that depends wholly on what the Windows security model requires. If it requires a complete change of the functioning of an otherwise benign and reasonable setup, then yes—it is an onerous requirement.

I don’t think VAC does the same thing, Safewood. I play VAC-enabled games all the time.

It sucks that I won’t be able to play Rust because of this, though.

Has anyone been in a similar position who knows a way that I might get this to work? Perhaps there’s a nuance or something to UEFI boots that I’m missing out on that’d allow me to use BCDEDIT.

Well, maybe not all VAC-enabled games, but for CS:GO it’s definitely required. You get kicked from Valve servers if you have DEP disabled.

Restore Boot Settings to Default

bcdedit /deletevalue nointegritychecks 
bcdedit /deletevalue loadoptions 
bcdedit /debug off 
bcdedit /deletevalue nx  

Source: https://support.steampowered.com/kb_article.php?ref=2117-ILZV-2837

It requires Driver Signing Enforcement, a cornerstone of Windows Vista and up.

Take that up with Microsoft and the fact that grub doesn’t play nice with Windows 7+'s security model, or fix your bootloader since you’re a power user with a grub dual-boot.

Now, see, here’s where progress can be made. You can switch to using the Windows bootloader instead of grub and creating a boot entry for the Linux partition.

Those instructions assume a fresh OS install and obviously that’s a little bit overkill for you; there’s bound to be a way of overwriting grub’s bootloader with the Windows one and then just rigging up the boot entry from there.

[editline]19th March 2016[/editline]

If it was as simple as running bcdedit I’d have already instructed AmagicalFishy to do that (if he hadn’t figured it out himself already, the likely situation). bcdedit doesn’t work when your machine’s booting with the Linux bootloader.

Read carefully when messing with bootloaders.

That’s not what I was getting at either. I wasn’t giving him a solution, but rather giving a source that VAC essentially does the same thing as EAC, which was my point.

Valve wouldn’t ask every day users to do something that could fuck up their PC’s. The commands just remove the previous switches and sets it to default; nothing more.

VAC does not do the same thing as EAC. When I mentioned that I’ve played VAC-enabled games very often, I was thinking specifically of CS:GO and DotA—neither of which I’ve ever had problems with. But, you might be right in that they may both require Driver Signature Enforcement. Contrary to the error message, that was not actually the issue. The issue seems to have been Test Signing (it turns out my DSE was enabled already).

elixwhitetail’s post reminded me of something I did a while ago, which lead me to a solution:

The only reason I ever log into Windows is to play games. There’s no way I was going to let that p.o.s. operating system manage anything ;). I used diskpart to assign a drive letter (Z:) to the UEFI partition, which allowed me to manipulate the files within. Then I manually directed BCDEDIT to the store and just disabled Test Signing. For anyone who has a problem using BCDEDIT for similar reasons:

select Disk 0
list volume
select volume x
(where x is the EFI partition; mine was labelled “EFI”)
assign LETTER = Z
BCDEDIT -store Z:\EFI\Microsoft\Boot\BCD -set TESTSIGNING OFF

Then restart and voila! Your file names and directories will vary. I logged into Ubuntu to find the location/name of the file, then did all the manipulations via CMD in Windows.

Yeah, if you’ve got test signing on, that’ll fuck it up just as much. If you’d been on a stock Windows box without grub in the mix I’d have just gone straight to trying to turn on DES/turn off Test Signing/etc. but grub provided an added complication.

Glad you figured out how to bcdedit it anyway! I wasn’t going to try and walk you through that because I didn’t know how your system was set up and didn’t want to risk bricking your bootloader.

Haha, I respect the caution. I’ve bricked my computer so many times screwing around w/ things I probably shouldn’t it’s sad.