Early Launch Anti-Malware (ELAM)

Early Launch Anti-Malware (ELAM) is a Windows boot-protection mechanism. It allows a specially signed antimalware driver to start before other third-party boot-start drivers, evaluate them, and help the Windows kernel decide whether each driver should initialize.

How ELAM works

1. The Windows boot loader loads boot-critical drivers and the registered ELAM driver.
2. Before another boot-start driver initializes, Windows gives the ELAM component information needed to classify it.
3. The security provider returns a classification such as known good, known bad, or unknown.
4. Windows applies its driver-load policy. The default policy blocks known-bad drivers while allowing known-good and unknown drivers; administrators can configure stricter behavior.

ELAM focuses on drivers that start during boot. It is not a replacement for a full file scan, behavior monitoring, or account protection after Windows has loaded.

ELAM and Secure Boot are different

Secure Boot validates trusted components in the boot chain. ELAM evaluates boot-start drivers early enough to stop a known malicious driver from initializing. The controls complement each other, but enabling one does not prove that the other is working.

If boot protection reports a problem

• Record the blocked driver name, publisher, file path, and any error code.
• Update Windows, the security product, and the affected hardware or software driver from official sources.
• Do not disable Secure Boot or weaken driver policy merely to make the warning disappear.
• If a legitimate update prevents a normal start, use Safe Mode to remove or replace that specific driver.
• If the driver is unfamiliar or returns after removal, scan for a rootkit and review recent administrative changes.

A normal restart is usually required after a driver or security update so the corrected boot component can load.