Windows 10 Pro final release Tap Driver Installation failure
I'm starting this mostly as a worklog to document the problems that have occurred trying to install the PIA software on the public release of Windows 10 Pro, 64 bit.
I'm currently running build 10240 and it is fully updated.
To date, working with PIA support Brendon T and Will B
First I installed the PIA software per the instructions on the website. The original installation seemed to work fine, but I discovered after trying to connect that the TAP driver wasn't installed correctly. I immediately contacted support and got a case going. While discussing my setup with the tech, he suggested some changes to my anti-virus (Kaspersky) which I did. I use a Zywall USG50 hardware firewall, so I have both the Kaspersky and Windows firewalls disabled, but I did put in the exceptions into the application scanning, etc, that were suggested.
Trying to reinstall the TAP driver from the start menu as an administrator was the first step. It failed (it takes approximately 4 minutes every time, btw). It just times out, and then you get a popup saying it failed. Each time you install, either PIA installer in the command window, or with the OpenVPN installer, it gives you a notice that you may need confirmation
...but there is no popup or anything for approval at any point, so this may also be one of the issues.
I then tried going to the device manager, which shows the driver in Other Devices, and tried updating from there. It also times out.
PIA support requested a copy of the setupapi.dev.log, which I sent them, and we both continued to research the problem.
Will B discovered that it seems that Windows 10 is handling driver signing differently than windows had in the past, so we tried rebooting with Driver Signature Enforcement disabled, and tried again. It continued to fail.
Next, we tried downloading the 64 bit version of OpenVPN for post Vista versions of Windows, and installing just the TAP driver, again with DSE disabled. It failed again.
In checking through problems with earlier builds of Windows 10, prior to the public release, it turns out there should be a registry entry for the Tap Adapter at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\[00XX] (XX being the adapter number, which varies by your particular setup. In my case, it's 14). The fix for previous versions had been to do the following:
add string value/data ComponentId/tap0901 (REG_SZ) with regedit
value name=ComponentId
value data=tap0901
The problem is, on my machine, this entry only has existed only for the 4 minutes during the TAP driver installation before it fails. Then it disappears. Making a change during the installation does nothing.
However...after this last try with the 64bit OpenVPN driver, I now have a registry entry, and the Tap Adapter shows up in the Network Adapters section, even though the installation said it failed.
Adding the ComponentID, unfortunately, didn't work.
So this is where we are at at this point.
I'll update this further as we try different things until there is a solution.
Edit: Instituted the following changes in Kaspersky as per PIA Support instructions:
These settings were changed in Kaspersky
Kaspersky
-> Settings -> General - Under the heading "Interactive
Protection", make sure that the option "Perform recommended actions
automatically" is not enabled.
Kaspersky -> Settings ->
Protection -> Firewall - Make sure that the option "Block network
connections if the user cannot be prompted" is not enabled - While the
VPN application is running (not necessarily connected), click on
"Configure application rules". There, under the Application heading,
locate both pia_tray.exe and pia_manager.exe, and under the Network
heading, click the icon drop-down menu found beside each app, and choose
Allow, then close the window (the changes take effect automatically) -
Click on Configure packet rules. There, locate "Any network traffic
(Local Network)", select it, and click Edit at the bottom. Change the
Action drop-down menu to Allow, and save the change. Repeat that process
for both "DNS over TCP" and "DNS over UDP" as well, then close the
window. NOTE: No changes were made to the firewall…it’s disabled, as is
the Windows Firewall. I have a hardware firewall, so I offload all
functions to that perimeter defense.
Kaspersky -> Settings -> Protection -> Application Control
- Under "Rules for applications, private data protection", click Manage applications
- Double-click on pia_tray.exe - On the "File and system registry" tab, make sure all options on all columns are set to Allow.
-
On the "Rights" tab, make sure all options on all columns are set to
Allow. - On the "Network rules" tab, make sure all options are set to
Allow.
- On the "Exclusions" tab, make sure all options here are enabled. - Save the changes.
- Repeat that process for pia_manager.exe as well.
Kaspersky -> Settings -> Additional -> Network
- Under "Monitored ports", change it to "Monitor selected ports only" and click the "Select" option
- Set the following ports to "Inactive": 50, 51, 53, 80, 110, 443, 500, 1194, 1701, 1723, 4500, 8080, 9201
Kaspersky -> Settings -> Additional -> Threats and Exclusions
- Click on "Specify trusted applications"
- Click "Add"
- Click "Browse"
- Browse to the first file in the list below, and click "Open"
- Enable all options except "Do not scan all traffic", and click Add.
- Repeat that process for all other files listed below:
C:/Program Files/pia_manager/openVPN.exe
C:/Program Files/pia_manager/pia_manager.exe
C:/Program Files/pia_manager/tapinstall.exe
C:/Program Files/pia_manager/installer_win.exe
C:/Program Files/pia_manager/pia_tray/pia_tray.exe
%LOCALAPPDATA%\Temp\ocr<randomcharacters>.tmp\bin\rubyw.exe
I'm currently running build 10240 and it is fully updated.
To date, working with PIA support Brendon T and Will B
First I installed the PIA software per the instructions on the website. The original installation seemed to work fine, but I discovered after trying to connect that the TAP driver wasn't installed correctly. I immediately contacted support and got a case going. While discussing my setup with the tech, he suggested some changes to my anti-virus (Kaspersky) which I did. I use a Zywall USG50 hardware firewall, so I have both the Kaspersky and Windows firewalls disabled, but I did put in the exceptions into the application scanning, etc, that were suggested.
Trying to reinstall the TAP driver from the start menu as an administrator was the first step. It failed (it takes approximately 4 minutes every time, btw). It just times out, and then you get a popup saying it failed. Each time you install, either PIA installer in the command window, or with the OpenVPN installer, it gives you a notice that you may need confirmation
...but there is no popup or anything for approval at any point, so this may also be one of the issues.
I then tried going to the device manager, which shows the driver in Other Devices, and tried updating from there. It also times out.
PIA support requested a copy of the setupapi.dev.log, which I sent them, and we both continued to research the problem.
Will B discovered that it seems that Windows 10 is handling driver signing differently than windows had in the past, so we tried rebooting with Driver Signature Enforcement disabled, and tried again. It continued to fail.
Next, we tried downloading the 64 bit version of OpenVPN for post Vista versions of Windows, and installing just the TAP driver, again with DSE disabled. It failed again.
In checking through problems with earlier builds of Windows 10, prior to the public release, it turns out there should be a registry entry for the Tap Adapter at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\[00XX] (XX being the adapter number, which varies by your particular setup. In my case, it's 14). The fix for previous versions had been to do the following:
add string value/data ComponentId/tap0901 (REG_SZ) with regedit
value name=ComponentId
value data=tap0901
The problem is, on my machine, this entry only has existed only for the 4 minutes during the TAP driver installation before it fails. Then it disappears. Making a change during the installation does nothing.
However...after this last try with the 64bit OpenVPN driver, I now have a registry entry, and the Tap Adapter shows up in the Network Adapters section, even though the installation said it failed.
Adding the ComponentID, unfortunately, didn't work.
So this is where we are at at this point.
I'll update this further as we try different things until there is a solution.
Edit: Instituted the following changes in Kaspersky as per PIA Support instructions:
These settings were changed in Kaspersky
Kaspersky
-> Settings -> General - Under the heading "Interactive
Protection", make sure that the option "Perform recommended actions
automatically" is not enabled.
Kaspersky -> Settings ->
Protection -> Firewall - Make sure that the option "Block network
connections if the user cannot be prompted" is not enabled - While the
VPN application is running (not necessarily connected), click on
"Configure application rules". There, under the Application heading,
locate both pia_tray.exe and pia_manager.exe, and under the Network
heading, click the icon drop-down menu found beside each app, and choose
Allow, then close the window (the changes take effect automatically) -
Click on Configure packet rules. There, locate "Any network traffic
(Local Network)", select it, and click Edit at the bottom. Change the
Action drop-down menu to Allow, and save the change. Repeat that process
for both "DNS over TCP" and "DNS over UDP" as well, then close the
window. NOTE: No changes were made to the firewall…it’s disabled, as is
the Windows Firewall. I have a hardware firewall, so I offload all
functions to that perimeter defense.
Kaspersky -> Settings -> Protection -> Application Control
- Under "Rules for applications, private data protection", click Manage applications
- Double-click on pia_tray.exe - On the "File and system registry" tab, make sure all options on all columns are set to Allow.
-
On the "Rights" tab, make sure all options on all columns are set to
Allow. - On the "Network rules" tab, make sure all options are set to
Allow.
- On the "Exclusions" tab, make sure all options here are enabled. - Save the changes.
- Repeat that process for pia_manager.exe as well.
Kaspersky -> Settings -> Additional -> Network
- Under "Monitored ports", change it to "Monitor selected ports only" and click the "Select" option
- Set the following ports to "Inactive": 50, 51, 53, 80, 110, 443, 500, 1194, 1701, 1723, 4500, 8080, 9201
Kaspersky -> Settings -> Additional -> Threats and Exclusions
- Click on "Specify trusted applications"
- Click "Add"
- Click "Browse"
- Browse to the first file in the list below, and click "Open"
- Enable all options except "Do not scan all traffic", and click Add.
- Repeat that process for all other files listed below:
C:/Program Files/pia_manager/openVPN.exe
C:/Program Files/pia_manager/pia_manager.exe
C:/Program Files/pia_manager/tapinstall.exe
C:/Program Files/pia_manager/installer_win.exe
C:/Program Files/pia_manager/pia_tray/pia_tray.exe
%LOCALAPPDATA%\Temp\ocr<randomcharacters>.tmp\bin\rubyw.exe
Comments
C:\WINDOWS\System32\DriverStore\FileRepository\oemwin2k.inf_amd64_f8aa8626e797ceb6\
In here should be a file called "tap0901" with the file type as
"Security Catalog". Doubleclick this. Then click "View
Signature". On the resulting window, click "View Certificate",
then "Install Certificate". Choose Next, leave it on
"Automatically select[...]", click Next again, and finally, choose
"Finish".
You should get the message "The import was successful." Reboot the
computer, and try once more to install the OpenVPN application, with its newest
TAP adapter.
- Go this page: https://openvpn.net/index.php/open-source/downloads.html
- In the colored box at the top of this screen, locate the and download the
OpenVPN installer for your Windows operating system.
_______________
If this doesn't help, please go into programs and features through control
panel. Uninstall anything in here related to "OpenVPN",
"TAP-Windows", and "Private Internet Access" (including
support files).
Then go into your C:\ drive. To do this, hit Windows+E on your keyboard, which
should bring up the Windows explorer. From here, go into C:\Program Files\, and
locate the pia_manager directory. Once you've located it, right-click on it,
and delete it entirely; this will remove all traces of our application from
your system.
Next, to access the Device Manager, hit Windows+X on your keyboard, and it will
bring up the Power User Menu. From here, click on Device Manager. Then, expand
Network Adapters, select the TAP32 adapter, right-click on it, and choose
Uninstall. When it prompts you, enable the option to remove the driver for the
device as well, then click OK to fully remove it.
After this, power off your computer, wait 60 seconds, and power it back up; all
traces of our app should now be removed from your system.
Then, please run this command in an administrative command prompt (right click
cmd.exe and choose "run as administrator"):
cd C:\
chkdsk /r
It will prompt for your confirmation, asking "Would you like to schedule
this volume to be checked the next time the system restarts? (Y/N)
Type y and press enter.
Reboot the computer.
On the way back up it will attempt to begin the checkdisk. If you don't press
any key, it should run through the entire process, making sure there are no
problems with the computer's system drive. Let me know if you notice any errors
after this completes.
Once it reboots and you're logged back in, attempt the sfc command again.
Run this command in an administrative command prompt (right click cmd.exe and
choose "run as administrator"):
sfc /scannow
Let this run its course - it may take a few minutes - and then reboot the
computer once more.
Disable the realtime protection of any anti-virus on the computer and then
install our client -
https://www.privateinternetaccess.com/installer/download_installer_win
Don't bother rebooting the computer unless you're prompted. Finally, try
installing the newest version of the TAP adapter over top of the existing PIA
installation:
http://build.openvpn.net/downloads/releases/tap-windows-9.9.2_3.exe
I installed the certificate, both to the user and the machine just to be sure, and followed the first set of instructions. The installation failed in the same manner after a 4 minute wait, just as all previous installations did.
I then moved to the second set of instructions. Before doing this, I ran a full scan with Kaspersky, Malwarebytes with the latest update, and ADWCleaner just to be sure I had no issues. Cleaned up what little bit there was there, and then completed the above procedure. Came back up, disabled Kaspersky, and tried the installation again using the second method. Both installations failed on TAP driver installation.
I tried again from scratch, following the outlined steps, but this time I went into the Kaspersky ap and disabled it completely, and set it not to start at reboot. I then did a clean boot with all but MS services disabled at boot, booting into troubleshooting mode and choosing the F8 option to disable any malware services, just to be sure nothing was running.
Mode. First, uninstall any components of PIA that were installed. If the TAP
adapter doesn't show up (likely), then skip that step and complete the
remaining ones.
First, you need to go into your C:\ drive. To do this, hit Windows+E on your
keyboard, which should bring up the Windows explorer. From here, go into
C:\Program Files\, and locate the pia_manager directory. Once you've located
it, right-click on it, and delete it entirely; this will remove all traces of
our application from your system.
Next, to access the Device Manager, hit Windows+X on your keyboard, and it will
bring up the Power User Menu. From here, click on Device Manager. Then, expand
Network Adapters, select the TAP32 adapter, right-click on it, and choose
Uninstall. When it prompts you, enable the option to remove the driver for the
device as well, then click OK to fully remove it.
After this, power off your computer, wait 60 seconds, and power it back up; all
traces of our app should now be removed from your system.
Then, try booting Windows 10 into Safe Mode to test the installation.
1. Log on to the Windows 10 computer with any administrator account.
2. Once on the desktop screen, press the Windows + R keys simultaneously on the
keyboard.
3. In the available field of the opened Run command box, type MSCONFIG and
press Enter.
4. From the System Configuration box, go to the Boot tab.
5. Under the Boot options section, check the Safe boot checkbox.
6. Click OK, and when prompted, click Restart to start Windows 10 in Safe Mode.
Try downloading a new installer, right-click it, and run as admin.
https://www.privateinternetaccess.com/installer/download_installer_win
I tried the installation per instructions after purging all
instances of both OpenVPN’s driver and PIA’s software. I used the Advanced
Uninstaller tool to make sure there were no traces in the registry as well.
I then downloaded a fresh copy of the installer from the link
provided, and rebooted into safe mode per instructions.
The installation went fine with the exception of an error message that flashed
in the command window about not being able to connect to an IP (understandable
in Safe Mode as the network is not available). For the first time, the TAP
driver installation completed successfully in seconds, and it shows up in the
device manager under the Network Adapters rather than as an error in Other
Devices.
However…when I rebooted back into normal mode, I ran PIA as an
administrator, provided my credentials, tried connecting to US East, and ended
up with the same error saying to reinstall the Tap Driver that I always get
when I try to connect with the application. The error popup repeats every 60 seconds until you disconnect.
Then, just as a follow up, I tried a couple of other things based on
conversations I’ve had with other PIA techs, but using safe mode for the
installation.
First I uninstalled the TAP-Windows Adapter V9 from the device
manager, using the option to delete the driver as well. Then I rebooted into
safe mode, but this time with networking, and I installed the
tap-windows-9.21.1.exe file (with NDIS 6 for windows versions above XP),
as administrator, from the OpenVPN downloads. This time the installation did
what all previous installations did…it failed after sitting for 4 minutes at
the Tap driver installation. The Tap Adapter then moved from the Network
Adapters section of the device manager to the Other Devices after the
installation failed, which is normal…and the registry entry was deleted.
So next I deleted the adapter again, and then rebooted back into safe mode.
This time without networking. I then tried an installation using the
openvpn-install-2.3.8-I601-x86_64.exe file, and deselected all elements except
the Tap driver. This time the installation completed quickly, as it did with
the PIA installation. No 4 minute wait, and no time out/error. The adapter
showed up under Network Adapters, as it should, instead of Other Devices.
I then disabled all antivirus/anti-malware software and ran the PIA as
administrator and tried to connect to US East (I’m in Florida btw). The ap then
tries to connect for 60 seconds and then the reinstall tap driver pop-up
appears. A new one does so every 60 seconds until you press disconnect.
Turns out the culprit was Kaspersky Internet Security (version 15.0.2.361 to be exact).
I set up an isolated vlan and moved my computer out to it to isolate it from my network, but still kept it behind my firewall (Zywall usg50).
I then uninstalled Kaspersky using their tool and following the instructions on their site. Then, just to be sure, I used the tool from Bleeping Computer just to be sure there was no remnants, as well as a registry tool in Advanced Uninstaller to make sure the registry was clean as well.
I then followed the directions to remove the PIA app, and went into the Device Manager and uninstalled the TAP v9 Adapter including the option to delete the driver.
I shut down my computer for 90 seconds. I then brought it back up into safe mode and installed the latest copy of the PIA application (which I downloaded before shutting down). This time, for the first time, it installed flawlessly in a few seconds with no errors. I rebooted into normal mode and started the application. I then tried connecting to several different servers, which worked with no issues, and no error message asking me to reinstall the tap driver...again, for the first time.
I then connected to the East Coast server and left it up over night. It stayed connected for 12 hours before I disconnected it to move my computer back into the home network vlan, and reinstall Kaspersky.
I installed Kaspersky Internet Security 2016, and activated it, and then tried reconnecting to the PIA east coast server. It worked as expected, and has remained connected for the last 6 hours.
So...the culprit in this case seems to be Kaspersky, which despite having opened every port, trusted every app, and generally allowed everything that PIA or OpenVPN uses individually, it still would not install.
I was having this problem as well. I tried a number of things (I am not using Kaspersky, so I can't comment on whether that's an issue) and finally found the solution, at least in my case.
My Ethernet connection was called "Ethernet 2". I think this was because I had installed VirtualBox some time in the past. When I upgraded from Windows 8 to Windows 10, PIA continued to work fine. Today, I upgraded PIA due to a security alert from PIA about a flaw that had been fixed but the TAP would not re-install (hung for minutes and then failed).
My fix was to rename my Ethernet connection from "Ethernet 2" to "Ethernet" and re-running the TAP installation -- it installed without any delays and the VPN connection started working immediately. The newly installed TAP connection is called "Ethernet 2". I suspect that the TAP software is hard-wired to be installed as "Ethernet 2" and this name conflict prevents the installation of the TAP driver if you already have an Ethernet connection called "Ethernet 2". Alternately, perhaps the TAP driver is looking for an Ethernet connection called "Ethernet" to attach to.
To rename your Ethernet connection:
1) Right click on your network icon in the lower right corner of your Windows desktop.
2) Click on "Open Network and Sharing Center".
3) In the left column of the Network and Sharing Center, click on "Change Adapter Settings".
4) If your Ethernet connection (not the TAP connection) is called "Ethernet 2", right click on that adapter and select "Rename". Change the name to "Ethernet" and press Enter.
5) Reinstall the TAP driver from the Windows menu (I.e. type PIA into the "Search Windows" box to find the "Reinstall TAP driver" application.
This worked for me. Your mileage may vary.
Best,
Geoff
Same configuration, same symptoms, no third-party virus protection - I'm not sure if it's a factor, but I do have VirtualBox installed.
Just to clarify the procedure ...
I have uploaded it to my one drive, you can download from here.
https://connectmanagedo365-my.sharepoint.com/:u:/g/personal/kaleem_connectmanaged_com/EQl2R5gh1YdAoO00xJnmIOgBAjcXz28-Vi9U_Pj7F4yDvg?e=kJAoIR
if you don't fancy downloading then you can download open VPN installer.exe and then extract contents of exe to a folder and get the TAP-WINDOWS.EXE from $TEMP folder
regards,
Kaleem