Specifies that all methods can be used to verify the file. First, the catalog databases are searched to determine whether the file is signed in a catalog. If the file is not signed in any catalog, SignTool attempts to verify the file's embedded signature. This option is recommended when verifying files that may or may not be signed in a catalog. Examples of files that may or may not be signed include Windows files or drivers. (signtool option: /a)

Verifies all signatures in a file with multiple signatures. (signtool option: /all)

Displays debugging information. (signtool option: /debug)

Print the description and description URL. (signtool option: /d)

Specifies the name of the subject of the root certificate that the signing certificate must chain to. This value can be a substring of the entire subject name of the root certificate. (signtool option: /r RootSubjectName)

Timeout.

Path to signtool.exe. If not provided, an attempt will be made to locate it automatically in 'Program Files (x86)\Windows Kits'.

Specifies that the Default Authentication Verification Policy is used. If the /pa option is not specified, SignTool uses the Windows Driver Verification Policy. This option cannot be used with the catdb options. (signtool option: /pa)

Uses multiple verification semantics. This is the default behavior of a WinVerifyTrust call. (signtool option: /ms)

Performs the verification by using the x64 kernel-mode driver signing policy. (signtool option: /kp)

Output verbosity. (signtool options: /q, /v)

Verifies the file by operating system version. The version parameter is of the form: PlatformID**:VerMajor.VerMinor.**BuildNumber. The use of the /o switch is recommended. If /o is not specified SignTool may return unexpected results. For example, if you do not include the /o switch, then system catalogs that validate correctly on an older OS may not validate correctly on a newer OS. (signtool option: /o Version)

Verifies the signature at a certain position. (signtool option: /ds Index)

Specifies that a warning is generated if the signature is not time stamped. (signtool option: /tw)

Working directory. If not provided, current directory will be used.

Options default values.