WDM driver can't be installed in win2019 with error 0x80070002

Nan Yang 1

Our product has a WDM driver for several years, it works well for all previous window version, but recently we need to upgrade to window 2019 which already opened the test mode, the setup API always failed with error message "A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider."
We found it eventually copied the inf file to C:\Windows\System32\DriverStore folder and the driver binary to C:\Windows\System32\drivers folder after calling SetupCopyOEMInf(), but when call the INetCfgClassSetup->install method, the driver service was not created, it just return 0x80070002, however,we can create the service manually by sc create binPath="C:\Windows\System32\drivers<drivername>.sys" type=kernel,and it could start well.
Not sure why this happened, no log or event trace could be watched, do you have any idea?

Doron Holan 1,801 Reputation points

2021-05-24T22:56:15.987+00:00

does setupapi.dev.log give any more detail? how is the driver signed? by windows 2019 do you mean server?
Nan Yang 1 Reputation point

2021-05-25T03:22:22.353+00:00

It mainly used below cmd to sign the driver:
makecert.exe -a sha256 -r -pe -n CN=$(DDKCertName) -sv $(DDKTestCertPath).pvk $(DDKTestCertPath).cer
inf2cat.exe /driver:$(DDKOutputDir) /os:ServerRS5_$(DDKInf2CatArch) /USELOCALTIME"
SignTool.exe sign /f $(DDKTestCertPath) /p $(DDKOutputDir)$(Name).$(Ext)"

We installed the generated cert to root cert store and trust publisher store, and then call setup API to install driver to window,the only useful info in setupAPI.dev.log is "A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider".

We also have other two NDIS filter drivers which used the same way to sign, but they didn't meet the issue.

Our environment is window server 2019, build 17763 which is running on a VM.

Share via

WDM driver can't be installed in win2019 with error 0x80070002