How to correctly validate WDAC Disabled:Flight Signing with a flight-signed user-mode DLL

I am testing WDAC/App Control for Business and need Microsoft's guidance on how to correctly test the Disabled: Flight Signing policy option.

Test environment

Host OS: Windows Server 2022 <Edition / Build>

Test OS: Windows 11 <Edition / Version / Build>

The Windows 11 installation image was obtained from UUP Dump and used to create the Windows 11 test environment.

WDAC is running in enforcement mode.

Relevant policy options:

Enabled:UMCI

Enabled:Update Policy No Reboot

Disabled:Flight Signing

Test performed

I obtained FlightTest.dll from UUP Dump and copied it to the Windows 11 test machine:

C:\Users<user>\Desktop\FlightTest.dll

I verified the DLL signature. It shows:

Publisher: Microsoft Windows

Issuer: Microsoft Development PCA 2014

Root: Microsoft Development Root Certificate Authority 2014

I created a simple .NET 8 user-mode application, FlightLoader.exe, that uses the Windows LoadLibrary() API to load FlightTest.dll.

With Disabled:Flight Signing enabled, the application reported:

Attempting to load:

C:\Users<user>\Desktop\FlightTest.dll

DLL LOAD SUCCEEDED

I checked Microsoft-Windows-CodeIntegrity/Operational, but did not find an Event 3077 indicating that FlightTest.dll was blocked.

I found that the policy initially contained the Microsoft Flight signer in the UMCI AllowedSigners. I removed that Flight signer and its corresponding AllowedSigner entry while keeping Disabled:Flight Signing enabled.

I incremented the policy version, recompiled and signed the policy, deployed it to:

C:\Windows\System32\CodeIntegrity\CiPolicies\Active\

and refreshed the policy using RefreshPolicy.exe.

After this change, the FlightLoader application itself was blocked because its FlightLoader.dll dependency was not allowed. Therefore, this second test did not reach FlightTest.dll, and I cannot use it to determine whether Disabled:Flight Signing is working as expected.

Questions

Could someone please clarify:

1. Is FlightTest.dll obtained from UUP Dump an appropriate test binary for validating Disabled: Flight Signing?

Is using a simple user-mode application with LoadLibrary() a valid and supported method for testing this policy option against a DLL?

1. How should I configure the test application and its .NET dependencies so that the test harness is allowed, while FlightTest.dll remains subject to the Disabled: Flight Signing check?
2. If Disabled: Flight Signing blocks the DLL, should the expected result be Event 3077, with a correlated Event 3089 showing VerificationError = 24 ("Flight root not allowed")? Microsoft's documentation identifies 3077 as the enforcement block event and 3089 as the associated signature-information event.
3. Is there an official Microsoft test binary or recommended procedure for reliably testing Disabled: Flight Signing?
4. Could using a Windows 11 installation image obtained through UUP Dump affect Flight Signing or Code Integrity behaviour?

I would appreciate guidance on the Microsoft-recommended procedure for creating a reliable and reproducible test of Disabled: Flight Signing.

I am testing WDAC/App Control for Business and need Microsoft's guidance on how to correctly test the Disabled: Flight Signing policy option.