Ghost/Hidden Network Interfaces
Question
Thursday, July 30, 2009 9:24 AM
Hi guys,
we have a problem with network management in the guest virtual machines with Windows Server 2008. We have created a VM with WinSrv 2008, we have deleted it leaving the vhd because we had to move it in another partition, but when we create a new VM attaching its original vhd WinSrv 2008 shows 3 network interface inside the guest OS (2 of which are hidden and not viewable in the device manager even with the "show hidden device" option) and the device manager create a new network adapter with the name "Microsoft Virtual Machine Bus Network Adapter #3". With a guest VM with WinSrv 2003 the behavior is different and the device manager shows only one interface with the default name "Microsoft Virtual Machine Bus Network Adapter". How can we remove these hidden/ghost interfaces? We hope you can help us quickly because next week this virtual environment should be perfectly working.
Have a nice day.
All replies (17)
Thursday, July 30, 2009 9:47 AM ✅Answered | 9 votes
Hi,
You can try this:
http://support.microsoft.com/kb/315539/en-us
To work around this behavior and display devices when you click Show hidden devices:
Click Start, point to All Programs, point to Accessories, and then click Command Prompt.
At a command prompt, type the following command , and then press ENTER: set devmgr_show_nonpresent_devices=1
Type the following command a command prompt, and then press ENTER: start devmgmt.msc
Troubleshoot the devices and drivers in Device Manager.
NOTE: Click Show hidden devices on the View menu in Device Managers before you can see devices that are not connected to the computer.
When you finish troubleshooting, close Device Manager.
Type exit at the command prompt.
Regards,
KOLARIK
Nelson Kolarik - Brasília - DF
Monday, August 3, 2009 9:53 AM ✅Answered | 3 votes
Hi,
It seems that the network adapter has been removed from the device manager, but some registry entry still remained in the registry.
Please try this KB.
http://support.microsoft.com/kb/269155
The DevCon utility is a command-line utility that acts as an alternative to Device Manager. When you use DevCon, you can enable, disable, restart, update, remove, and query individual devices or groups of devices. To use DevCon, follow these steps:
- Download the DevCon tool by clicking the following article number to view the article in the Microsoft Knowledge Base:
311272 (http://support.microsoft.com/kb/311272/ ) The DevCon command-line utility functions as an alternative to Device Manager
- Unpack the 32-bit or 64-bit DevCon tool binary to a local folder.
- Click Start, click Run, then type cmd and press ENTER.
- Type CD:\path_to_binaries to navigate to the devcon.exe is located.
- Use the following syntax to find installed network adapters:
devcon findall =net or
devcon listclass net
Note In the output of the previous commands, there is a line for the ghosted network adapter that is similar to the following:
PCI\VEN_10B7&DEV_9200&SUBSYS_00D81028&REV_78\4&19FD8D60&0&58F0: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
- Remove the ghosted device by typing the following syntax:
devcon -r remove "@PCI\VEN_10B7&DEV_9200&SUBSYS_00D81028&REV_78\4&19FD8D60&0&58F0"
Best Regards,
Vincent Hu
Thursday, July 30, 2009 11:07 AM
Great tip! It works perfectly! I used it migrating from Virtual Server 2k5 to Hyper-V but I didn't mind using it even in this situation.
Thank you very much!
Have a nice day.
Thursday, July 30, 2009 12:47 PM
A little tip about moving VM's: next time, use the export/import function. This will leave the configuration intact.
kind regards,
Floris van der Ploeg
Thursday, July 30, 2009 2:15 PM
If is it possible I'd like to receive another little help ;-) this tip works perfect with all of mine VM except of one. I think to have done some bad configuration trying to solve this problem.
In the device manager I have only one network adapter called: Microsoft Virtual Machine Bus Network Adapter but tools like bginfo (that do a wmi query) shows me 3 MAC address and 3 NICs. How is it possible? Some wrong key in the registry?
Do you have some suggestions?
Thanks in advance.
Have a nice work!
Michele
Thursday, July 30, 2009 2:21 PM
Michele,
you may have two network interfaces hidden yet.
try the workaroung again and remove all network adapters(maybe you have others hidden network adapters), later you click to refresh and find new (and one) Network Interface and configuring tcp/ip again.
regards,
KOLARIKNelson Kolarik - Brasília - DF
Thursday, July 30, 2009 3:34 PM
Hi Nelson,
unfortunately this workaround doesn't work in this situation. There are no more hidden devices. Are there some other ways to show hidden network interfaces? If bginfo shows me I suppose that Windows is reading this information somewhere ;-)
Do you know where can I find these ghost interfaces?
Thanks a lot.
Regards, Michele.
Thursday, July 30, 2009 3:51 PM
Can you show bginfo results and ipconfig /all?
KOLARIK
Nelson Kolarik - Brasília - DF
Thursday, July 30, 2009 4:20 PM
IPCONFIG:
Windows IP Configuration
Host Name . . . . . . . . . . . . : ex2007-01
Primary Dns Suffix . . . . . . . : gruppocbs.lan
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : gruppocbs.lan
Ethernet adapter eth0:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Virtual Machine Bus Network Ada
pter
Physical Address. . . . . . . . . : 00-15-5D-02-04-1D
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.2.17(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.10.2.254
DNS Servers . . . . . . . . . . . : 10.10.2.10
10.10.2.16
NetBIOS over Tcpip. . . . . . . . : Disabled
Tunnel adapter Local Area Connection* 8:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{FB203F77-97B4-44F6-8FC2-5AFF32519
F7A}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 9:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
BGINFO:
http://www.tecnotel.it/bginfo.jpg
Michele
Thursday, July 30, 2009 5:18 PM
Michele,
I tried in my notebook Windows 2008 with Hyper-V, I have Tunnel adapter but the information is hidden in bginfo.
You can create a BGINFO Custom wmi query like this :
SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE
SELECT DefaultIPGGateway FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE
SELECT MACAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE
Regards,
KOLARIK
Read this http://technet.microsoft.com/en-us/network/cc987595.aspx
Why do I have multiple interfaces?
A. When you type the netsh interface ipv6 show interface command for Windows Server 2003, Windows XP with SP2, or Windows XP with SP1, you see a list of all of the IPv6 interfaces:
Interface index 1 is a pseudo-interface that is used for loopback (named the Loopback Pseudo-Interface).
Interface index 2 is a pseudo-interface that is used for the Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) IPv6 transition technology (named the Automatic Tunneling Pseudo-Interface).
Interface index 3 is a pseudo-interface that is used for 6to4 tunneling (named the 6to4 Tunneling Pseudo-Interface).
Other interfaces are numbered sequentially in the order in which they are created. This order varies among computers.
With the exception of the Loopback Pseudo-Interface, your interfaces might be different. The link-local address of a LAN interface uses the IPv6 interface identifier derived from the Ethernet MAC address, as described in the "How is the link-local address derived?" question in this article.
Q. Why do I have an "Automatic Tunneling Pseudo-Interface" interface?
A. IPv6 in Windows XP and Windows Server 2003 uses the "Automatic Tunneling Pseudo-Interface" for encapsulating IPv6 packets with an IPv4 header so that they can be sent across an IPv4 network. By default, IPv6 configures a link-local Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) address on the Automatic Tunneling Pseudo-Interface. The link-local ISATAP address has the form fe80::200:5efe:w.x.y.x or fe80::5efe:w.x.y.x, in which w.x.y.x is an IPv4 address assigned to the computer.
How do I disable IPv6 in Windows Vista and Windows Server 2008?
A. Unlike Windows XP and Windows Server 2003, IPv6 in Windows Vista and Windows Server 2008 cannot be uninstalled. However, you can disable IPv6 in Windows Vista and Windows Server 2008 by doing one of the following:
In the Network Connections folder, obtain properties on all of your connections and adapters and clear the check box next to the Internet Protocol version 6 (TCP/IPv6) component in the list under This connection uses the following items.
This method disables IPv6 on your LAN interfaces and connections, but does not disable IPv6 on tunnel interfaces or the IPv6 loopback interface.
Add the following registry value (DWORD type) set to 0xFFFFFFFF:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents
This method disables IPv6 on all your LAN interfaces, connections, and tunnel interfaces but does not disable the IPv6 loopback interface. You must restart the computer for this registry value to take effect.
Nelson Kolarik - Brasília - DF
Friday, July 31, 2009 11:04 AM
Mmmm, it's very difficult for me to understand why I have only one ethernet connection in bginfo in all VM with WinSrv2k8 except of this... I don't think that it's something about ipv6 because I disabled it on all our VM. I really think that it's caused by some of my wrong configurations but I don't know what.
Obviously with the custom parameter (WMI query), bginfo shows me the correct informations... I knew this tip and I used it for teaming network interfaces ;-) but in this situation I cannot understand where OS reads these ghost parameters.
I repeat: all seems to work good, it's only a "visual" problem, but I'm very curious to understand what is causing this behavior...
Thanks again.
Regards.
Thursday, August 6, 2009 3:22 AM
· Hi,
Have you tried the suggestion? I want to see if the information provided was helpful. Your feedback is very useful for the further research. Please feel free to let me know if you have addition questions.
Best regards,
Vincent Hu
Monday, August 17, 2009 9:17 AM
Hello Vincent,
I have the same problem. The Bginfo.exe utility displays 2 Microsoft Virtual Machine Bus Network Adapters (only last is populated with IPv4 info). The Divice Manager is clean; no hidden network adapters. The registry appears to be clean. Yet, Bginfo reads a ghost adapter and its MAC address from somewhere. It is definitely not from the relevant WMI classes. I manually queried Win32_NetworkAdapter and Win32_NetworkAdapterConfiguration and found that all instances are accounted for.
I also used the Devcon.exe utility to no avail. It list everything that I can see in the Device Manager and/or the registry.
The MAC address that is assigned to the ghosted adapter confirms that it was a previously emulated Microsoft Virtual Machine Bus Network Adapter. If you can find out from where the Bginfo.exe utility reads the default <Network Card>, <MAC Address>, or <IP Address> information, we can quickly locate the stale data.
Please let me know.
Monday, November 9, 2009 12:02 PM
Hi Vincent,
with this very useful tool I've solved my problem!! Thank you very much for your help and sorry for my late (unfortunately I cannot receive the update by e-mail :-(( ).
Have a nice day and thank you again!
Michele
Wednesday, June 25, 2014 10:56 PM
Devcon won't remove some items as their related registry entries are locked down. These could be run if you were trying to remove them as system.
I've written a PowerShell script, which could resolve your issue. Please check it out, and if it resolves your issue, please mark my answer as correct:
Monday, March 9, 2015 7:52 PM
Perfect! This worked for me.
Wednesday, September 23, 2015 4:33 AM
Holy smokes this worked for me!
The devcon findall =net command showed me the adapter that was hidden and erased it with your devcon -r remove command.
Great job to all - perfect and to the point instructions.
Thanks guys!