DepthAI 3.8.0 blocked by Windows App Control (Code Integrity Event 3077)

tomkop

Hello Luxonis Support,

I am evaluating an OAK-D Lite AF camera and encountered an issue before I was able to communicate with the device.

Environment

Camera: OAK-D Lite AF
Operating System: Windows 11 Pro x64
Python: 3.13.14 (64-bit)
DepthAI: 3.8.0 (installed from the official PyPI package)
NVIDIA Quadro P2000
PyTorch 2.7.1 + CUDA 11.8

The Python package was installed from the official PyPI repository and the installation completed successfully.

Problem

Importing the library fails immediately:

$$
import depthai as dai
$$

with:

$$
ImportError: DLL load failed while importing depthai:
Application Control policy blocked this file.
$$

Windows Code Integrity logs Event ID 3077 with the following message:

$$
python.exe attempted to load

msvcp140_2-26883win.dll

which did not meet the Enterprise signing level requirements or violated Code Integrity policy.
$$

Investigation already performed

I verified the following:

The installed package is the official depthai package from Luxonis.
The blocked DLL is:

$$
C:\TK\RobotVision.venv\Lib\site-packages\msvcp140_2-26883win.dll
$$

The DLL is not digitally signed (Authenticode: NotSigned).
I downloaded the official depthai-3.8.0 wheel from PyPI.
I extracted the wheel and compared the DLL.

Result:

The SHA-256 hash of the installed DLL is identical to the DLL contained in the official wheel.

SHA-256:

$$
D06B3917E2785264CEABA497290413CE3BE252B57D182C41F7DD641ED561CE9A
$$

Therefore, I am confident the DLL has not been modified after installation.

Question

Is this DLL intentionally distributed without a digital signature?

Do you have:

a signed Windows build,
a recommended installation method for systems protected by Windows App Control / WDAC,
or any official workaround that does not require disabling Windows security features?

I would strongly prefer to keep Windows App Control enabled if possible.

Thank you very much for your help.

Best regards,
Tomas

SasoTamse

Hello tomkop - If possible, could you please ask your security administrator to try a narrowly scoped WDAC supplemental policy using hash-based allow rules for the unsigned binaries in the verified DepthAI wheel?

A hash-based rule is preferable to a broad path-based rule, especially because the Python virtual-environment directory may be writable by the user.

Please note that Windows may initially report only the first blocked dependency. After allowing that file, additional DepthAI .pyd files or bundled DLLs may also require equivalent hash rules. These rules would also need to be updated when upgrading to a different DepthAI version.

This approach should allow you to keep Windows App Control enabled while limiting the exception to the exact verified binaries.

Best regards,

Sašo