Turning test mode off works. Then you restart, and the watermark is back, as if you never ran the command. You are not imagining it and the command is not broken. Something on your PC has administrator rights and a reason to re-enable test signing, and it does so on a schedule. This guide finds it methodically.
A boot setting does not flip itself. If testsigning returns to Yes after every restart, a program, a scheduled task, a startup script or a management policy is setting it. The mistake people make is fighting it with the off command again and again. That treats the symptom daily and the cause never. The correct approach is a short investigation: confirm the pattern, list the suspects, and remove the re-enabler, not the setting. The suspects are almost always ordinary software, not anything sinister.
Before accusing any software, remove the innocent explanations. Turn test signing off in an elevated prompt, then choose Restart, not Shut down. Windows fast startup can make a shutdown behave like a hibernation resume, which muddies every boot test. After the restart, run bcdedit /enum {current} and read the testsigning line. If it now says No and the watermark is gone, there was never a culprit, just fast startup confusion. If it says Yes, you have a genuine re-enabler and the rest of this guide applies.
Software that re-applies test signing shares a profile: it works at a low level and needs its own driver loaded. The common categories are hardware utilities for older devices, phone flashing and unlocking tools, emulators and virtual hardware software, certain game related tools, and driver packages for obscure adapters. Some of these set the flag on every launch; a few install a scheduled task or a startup entry that sets it at every sign-in.
bcdeditOnce you have a prime suspect, prove it before uninstalling anything. Turn test signing off, restart and confirm it stays off. Then launch the suspect program once, restart again, and check the testsigning line. If it flipped back, you have your culprit beyond reasonable doubt.
Now the honest decision. If the program is something you no longer use, uninstall it and the problem ends. If you still use it but its device has a properly signed driver available from the maker's website, install that driver and the program usually stops needing the flag. If the program genuinely cannot work without test signing, you are no longer fighting a mystery; you are making a choice, and the trade-off guide in this set helps you make it deliberately instead of by accident.
On a company managed PC there is one more possible author: your IT department's own tooling or policy. Some organisations deliberately keep a setting through their management software, and fighting it locally is pointless. If this is a work machine and test mode returns no matter what, report what you found, the application you suspect and the bcdedit readings. That is a better ticket than most IT teams ever receive, and they can change the source instead of your PC.
See every step done live on a real Windows PC in the Technical Anshu video, including the exact command and the restart.
▶️ Watch Full VideoIt is possible in theory, because malware with admin rights would love weaker driver rules, but in practice the cause is almost always a legitimate tool you installed. Still, if you cannot identify any suspect program, run a full scan with your antivirus and with Windows Security's offline scan option. Treat an unidentified re-enabler on a PC with no low-level tools as a reason to look properly.
Some tools leave behind a scheduled task or a startup entry even after uninstall. Recheck Task Scheduler and the Startup tab for leftovers bearing the program's name, and disable the orphaned entry. Then turn test signing off, restart, and verify. Leftover automation outliving its program is common and is not a sign of anything worse.
That depends on the machine and what it holds. Test mode lowers the driver signature barrier for the whole PC, all the time, not just while your tool runs. On a spare or single-purpose PC the trade may be acceptable. On your main PC with banking, work and personal data, the honest recommendation is to find a signed driver or a different tool instead.