Driver package failed signature validation when McAfee Endpoint Security is installed #226
Comments
|
@neradha, it appears that some security solutions, like McAfee Endpoint Security and other similar products are actively preventing legitimate applications like Zadig from installing certificates into the Windows certificate store. See #225 for instance. The following points to your environment effectively preventing Zadig from accessing the certificate store. Also, you truncated the loge (PLEASE don't do that!), so I am missing crucial information that could potentially allow me to help you better. @FardinA143, please produce a complete log. I'm afraid |
@pbatard thanks for your reply. I reproduced the issue and you can see the full log below. Why would the driver replacement work the first time with the first device of that kind but not the second time - wouldn't this have failed both times if the cause of the problem was McAfee Endpoint security? |
All I know is that the only cause I have identified so far for the error you are seeing came from security solutions interfering with Zadig accessing the certificate store. On a vanilla version of Windows that uses the default security solution (Defender) with default settings, I have never seen it. Therefore, as far as I am concerned, the likely cause for So, again, I have to ask, do you have a non native security solution installed, or are using a non standard installation on Windows, where security settings may have been altered from their defaults? |
Yes, McAfee Endpoint Security is indeed installed on that computer. I was able to replace the driver onto the second device using another computer which runs only Windows Defender, so I will test if the driver replacement works on the first device using this other computer. This would be reproducing exactly the situation I had on the original computer, so if the driver replacement works then it would confirm that McAfee is at fault. I will update the issue once I do that test. |
Thanks. This is clearly the most likely culprit at this stage. |
|
I can confirm now that the driver replacement/installation worked on both identical devices when running Zadig on a computer that does not have McAfee installed. |
|
Can you please try to log an issue with McAfee? They are preventing legitimate applications from accessing the certificate store and negatively impacting end users. At any rate, there's not much I can do about this issue, so I will close this request (but you'll still be able to comment on it if you want). I will also alter its title so that people coming to this issue tracker get a better idea that McAfee Endpoint Security can cause problems. |
|
Please find enclosed the log message from McAfee when this issue happens: |
|
Well, it looks like McAfee have decided to declare the creation and installation of self-signed certificates in the Trusted Publishers store as EFS abuse. Unfortunately for them, there are very legitimate reasons to want to do that, such as needing to install a self-signed driver package on Windows 10 (since Windows 10 and later will reject any driver package that's not signed or whose signature validation chain does not end up with a certificate that is present in the certificate store). On Windows 10 and later, there is NO other alternative to installing a self signed certificate in Trusted Publishers if you want Zadig/libwdi to work without having to make your system less secure (by disabling signature validation altogether, which is not something you want to do), which means we must create RSA keys and self-signed certificates on the fly, and install them into the Trusted Publishers store, to be able to install the WinUSB driver in a generic manner. So, the McAfee engineers need to be made aware of this as well as this (especially points 4 and 5) and realise that their rule is preventing legitimate operations from working. Again, if you are facing this issue, you will need to report this false positive to McAfee support so that they relax their rule, because there's nothing we can do about an AV application that erroneously prevent a completely legitimate operation from being completed. |
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I've been trying to replace a driver with WinUSB for a particular device (Quad RS232-HS), but the driver installation fails (see full log at the bottom).
The day before, I successfully replaced the driver of another device of the same type. Since then, no configuration in the computer has changed. No Windows update, the Firewall was not disabled, the same version of Zadig was used (2.6). I have administrator rights. The second device was then connected to the same USB port as the first one for which the driver replacement succeeded. I then also changed USB ports but the same error occurred.
Could the problem be related to the fact that the two devices have the same VID&PID and there was some kind of clash when the .cat file was created for the second device?
The text was updated successfully, but these errors were encountered: