If you ever had to install private hotfixes from Microsoft, you most likely had to enable Test Signing (aka – Debug Mode) to install the binaries. Once done, you must uninstall the hotfix, reboot, then disable Test Signing and reboot again.

But sometimes, the Windows desktop’s wallpaper will keep the watermark. What gives?!

Let’s check a few things to make sure your environment is back to “default”. Pop open an administrative shell and run bcdedit /enum. Scroll down to loadoptions and make sure ENABLE_INTEGRITY_CHECKS is set.

If it is, let’s do a more extensive check by running bcdedit /enum all > bcd.txt (we’re piping the output to a text file because you’re about to dump a lot of text to the console). Open the text file and do a search for debugoptionenabled. If this is set to No, then we move onto the next step – checking certificates!

On the server, launch MMC and add the Certificate snap-in. Connect to the Current User store > Trusted Root > Certificates. Once there, scroll down and see if you see any certificates named Microsoft Test Root Authority or Microsoft Testing Root Certificate Authority.

If you do, delete them! The watermark will automatically disappear on its own without a reboot! These certs were simply not correctly removed when you disabled Test Signing.

Big shoutout to the Azure Stack HCI support team and the one-and-only Artem Pronichkin, who wrote an article on this exact behavior almost a decade ago!