Code Integrity error after enabled Secure Boot

Hello.

I'm using Bitdfender on Windows 11 Home and I am writing this post because I have a symptom that I would like to ask a question about.

I just enabled Secure Boot and since then I've been getting the following logs in Event Viewer.

Event ID 3033
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\SecurityHealthService.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\bdamsi\dlls_267059357120000000\antimalware_provider64.dll that did not meet the Windows signing level requirements.

Event ID 3089
Signature information for another event. Match using the Correlation Id.

Even if that error occurs, does Bitdfender work normally without any problems?
And I wonder if there is a way to fix it.

Below are other posts with the same symptoms, but it seems like the problem hasn't been resolved yet.

https://community.bitdefender.com/en/discussion/103265
https://community.bitdefender.com/en/discussion/95083

thx for reading

Find more posts tagged with

Comments

Davidwf

I too am seeing the same

dvsls

The behavior is expected and is caused by PPL signing-level differences in Windows.
SecurityHealthService.exe runs as a Microsoft Store-signed App PPL (level 5), while antimalware vendor components are signed at AM-PPL level 7.

To clarify:
Level 5 is only available to Microsoft Store-signed App PPL processes.
For antimalware vendors, the signing level is always 7.

Because of this, a load attempt from SecurityHealthService.exe can generate the reported error due to signing-level mismatch.
However, this does not indicate a protection failure—Bitdefender continues to operate normally and protection remains active.

Davidwf

so why cant it be corrected or amended to cater for this

dvsls

Because the files are signed in accordance with Microsoft requirements for antimalware vendor components, they use the highest level: 7 (AM-PPL).
The issue is that a Windows service with a lower signing level is attempting to load a binary signed at a higher level.