title: How to manually deploy a driver service?
body: <p>How do i manually deploy or register a Windows filter driver?</p>
  
  <p><strong>Warning</strong>: There's a lot of "proof of research effort" ahead. You don't have to read any more if you don't want to. I just point out, in detail, that i've tried what you're supposed to, i've tried what MSDN says, and i've tried everything anyone anywhere on the Internet has ever suggested.</p>
  
  <p>tl;dr: What's the <strong>intended</strong> way?</p>
  
  <h1>Background</h1>
  
  <p>I'm testing deploying a 64-bit driver developed in Visual Studio 2013 to a 64-bit Windows machine. I want to register the driver service with Windows, and start it.</p>
  
  <h1>What have you tried</h1>
  
  <ul>
  <li><p><strong>Visual Studio 2013 Driver Deployment feature</strong></p>
  
  <p>Ideally you would use the <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/jj863657(v=vs.85).aspx" rel="noreferrer">Visual Studio's capability to automatically deploy to a remote machine</a>. Unfortunately it just doesn't work (<em>"An extended error has occurred"</em>)</p></li>
  <li><p><strong>Using the Add New Hardware Wizard</strong></p>
  
  <p>Ideally you would use the Windows <strong>Add New Hardware Wizard</strong> (see the MSDN page <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff553639(v=vs.85).aspx" rel="noreferrer">Using the Add Hardware Wizard to Install a Driver Package</a>. Fortunately, starting with Windows 7, Microsoft removed the Add New Hardware Wizard from the Control Panel; requiring you to manually run <code>Hdwwiz.exe</code> from an elevated command prompt. Unfortunately you cannot use the <strong>Add New Hardware Wizard</strong> to add install a driver package, because the <strong>Add New Hardware Wizard</strong> only works with <em>hardware</em> (i.e. it doesn't work for filter drivers):</p>
  
  <p><img src="https://i.stack.imgur.com/8RPLg.png" alt="enter image description here"></p>
  
  <p>The wizard knows this, so doesn't offer to let you install any driver services.</p></li>
  <li><p><strong>SC Command line utility</strong></p>
  
  <p>Ideally you would register the driver service manually with the Service Control Manager with <strong><code>sc.exe</code></strong> tool from an elevated command prompt:</p>
  
  <pre><code>&gt;sc create MyDriver binPath="C:\Drop\Driver\MyDriver.sys" type=kernel
  &gt;[SC] CreateService SUCCESS
  </code></pre>
  
  <p>Unfortunately, even with a valid digital signature on the driver file:</p>
  
  <p><img src="https://i.stack.imgur.com/00tfP.png" alt="enter image description here"></p>
  
  <p>Windows will refuse to install the driver:</p>
  
  <p><img src="https://i.stack.imgur.com/EEGtd.png" alt="enter image description here"></p></li>
  <li><p><strong>OSR's Driver Loader Utility</strong></p>
  
  <p>Ideally one would use <a href="http://www.osronline.com/article.cfm?article=157" rel="noreferrer">OSR's Driver Loader utility</a>. But even with a validly digitally signed driver file, the driver will not install:</p>
  
  <p><img src="https://i.stack.imgur.com/943yD.png" alt="enter image description here"></p></li>
  <li><p><strong>.INF setup file</strong></p>
  
  <p>Ideally you would <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff544840(v=vs.85).aspx" rel="noreferrer">deploy the Driver Package and install it by installing from the <code>.inf</code></a>. Then i could just right-click the INF, select <strong>Install</strong>. But it just doesn't work - it doesn't register any new driver service.</p></li>
  <li><p><strong>.INF setup with with DefaultInstall section</strong></p>
  
  <p>Ideally you would just use a <code>.INF</code> file a <strong>DefaultInstall</strong> section. Windows would just execute the <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff547356(v=vs.85).aspx" rel="noreferrer">DefaultInstall</a> section. Unfortunately, MSDN warns that you're not allowed to use that for for drivers:</p>
  
  <blockquote>
    <p><strong>Note</strong>  The INF file of a <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff544840(v=vs.85).aspx" rel="noreferrer">driver package</a> must not contain an INF <strong>DefaultInstall</strong> section</p>
  </blockquote>
  
  <p>The reason you can't do it is because <strong>DefaultInstall</strong> has no <strong>AddService</strong> directive. Even if we ignore the warning and try anyway it just doesn't work - it doesn't register any new driver service.</p></li>
  <li><p><strong>.INF setup with DefaultInstall.Services section</strong></p>
  
  <p>While MSDN warns you against using DefaultInstall to register driver services, we can ignore them and use the <strong><code>[DefaultInstall.Services]</code></strong> section. Fortunately, it actually tries to install the driver service:</p>
  
  <p><img src="https://i.stack.imgur.com/Ukw9f.png" alt="enter image description here"></p>
  
  <p>but Windows then claims the driver is unsigned:</p>
  
  <p><img src="https://i.stack.imgur.com/YiRMU.png" alt="enter image description here"></p>
  
  <p>no driver service is actually registered.</p></li>
  <li><p><strong>SetupAPI InstallHinfSection function</strong></p>
  
  <p>Ideally i could use the SetupAPI to run the command line equivalent of the above:</p>
  
  <pre><code>&gt;RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Drop\Driver\ipfw.inf
  </code></pre>
  
  <p>Except the driver doesn't install. The function returns successfully; but Windows thinks the driver is unsigned:</p>
  
  <p><img src="https://i.stack.imgur.com/Ck26r.png" alt="enter image description here"></p></li>
  <li><p><strong>Use BCDEDIT to enable TESTSIGNING</strong></p>
  
  <p>Ideally i would follow the instructions from <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff553484(v=vs.85).aspx" rel="noreferrer">The TESTSIGNING Boot Configuration Option</a>, which says to run from an elevated command prompt:</p>
  
  <pre><code>&gt;Bcdedit.exe -set TESTSIGNING ON
  </code></pre>
  
  <p>Except that fails with the error:</p>
  
  <pre><code>&gt;Bcdedit.exe -set TESTSIGNING ON
  An error has occurred setting the element data.
  The value is protected by Secure Boot policy and cannot be modified or deleted.
  </code></pre></li>
  <li><p><strong>Use BCDEDIT to turn DEBUG on</strong></p>
  
  <p>Ideally i would follow the instructions on <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff547565%28v=vs.85%29.aspx" rel="noreferrer">Installing an Unsigned Driver during Development and Test</a>, which says to run from an elevated command prompt:</p>
  
  <pre><code>&gt;bcdedit -debug on
  </code></pre>
  
  <p>Except that fails with an error:</p>
  
  <pre><code>&gt;bcdedit -debug on
  An error occurred while attempting to modify the debugger settings.
  The value is protected by Secure Boot policy and cannot be modified or deleted.
  </code></pre></li>
  <li><p><strong>Use advanced recovery options to disable driver signing enforcement</strong></p>
  
  <p>Ideally i would use the advanced recovery options to disable driver signature enforcement:</p>
  
  <p><img src="https://i.stack.imgur.com/RjYr4.png" alt="enter image description here"></p>
  
  <p>Except after Windows starts driver signing is still enabled:</p>
  
  <p><img src="https://i.stack.imgur.com/vlXIE.png" alt="enter image description here"></p></li>
  <li><p><strong>Disable SecureBoot in the BIOS</strong></p>
  
  <p>Ideally in this virtual Hyper-V computer i would disable SecureBoot in its virtual BIOS:</p>
  
  <p><img src="https://i.stack.imgur.com/PZogk.png" alt="enter image description here"></p>
  
  <p>and then try disabling the driver signing policy.</p></li>
  </ul>
  
  <p>And oh my god three days on this. I'd like someone from Microsoft to explain:</p>
  
  <ul>
  <li>not only the correct way to test drivers during development</li>
  <li>but to explain, in detail, why each of the above attempts failed</li>
  </ul>
  
  <h1>What's the proper way</h1>
  
  <p>Rather than me trying random things, over, and over (and over, and over. And over), what is the <strong><em>right</em></strong> way to install a filter driver service?</p>
  
  <h1>Bonus Question</h1>
  
  <p>Why does Microsoft refuse to make life easier for developers?</p>
  
  <h1>Bonus Chatter</h1>
  
  <p>The driver file is signed with a valid, trusted, certificate. </p>
  
  <p><img src="https://i.stack.imgur.com/fevDe.png" alt="enter image description here"></p>
  
  <p>The certificate that signs the .sys driver file is also located in the <em>Local Machine</em> <strong>Trusted Root Certificates</strong> store:</p>
  
  <p><img src="https://i.stack.imgur.com/12nRv.png" alt="enter image description here"></p>
  
  <p>That is why the driver file's signature is valid and trusted.</p>
  
  <p>A throwaway comment on <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff547618(v=vs.85).aspx" rel="noreferrer">a random page on MSDN</a> says that test certificates must be added to two locations in the local machine store:</p>
  
  <blockquote>
    <p>The <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff553457(v=vs.85).aspx" rel="noreferrer">test certificate</a>s that are used to embed signatures in driver files and to sign a <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff544840(v=vs.85).aspx" rel="noreferrer">driver package's</a> <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff537872(v=vs.85).aspx" rel="noreferrer">catalog file</a> must be added to </p>
    
    <ul>
    <li>the <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff553506(v=vs.85).aspx" rel="noreferrer"><strong>Trusted Root Certification Authorities certificate store</strong></a> </li>
    <li>and the <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff553504(v=vs.85).aspx" rel="noreferrer"><strong>Trusted Publishers certificate store</strong></a>.</li>
    </ul>
  </blockquote>
  
  <p>Which explains why i added the certificate to another store:</p>
  
  <p><img src="https://i.stack.imgur.com/9CZuz.png" alt="enter image description here"></p>
  
  <p>Windows 10 Technical Preview, 64-bit</p>
  
  <h1>Bonus Reading</h1>
  
  <ul>
  <li><a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff553639(v=vs.85).aspx" rel="noreferrer">Using the Add Hardware Wizard to Install a Driver Package</a></li>
  <li><a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff557251(v=vs.85).aspx" rel="noreferrer">Using an INF File to Install a File System Filter Driver</a></li>
  <li><a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff557255(v=vs.85).aspx" rel="noreferrer">Using an INF File to Uninstall a File System Filter Driver</a></li>
  <li><a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff554015(v=vs.85).aspx" rel="noreferrer">Writing a Device Installation Application</a></li>
  <li><a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff547356(v=vs.85).aspx" rel="noreferrer">INF DefaultInstall Section</a></li>
  <li><a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff547646%28v=vs.85%29.aspx" rel="noreferrer">Installing Test Certificates</a></li>
  <li><a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff547618(v=vs.85).aspx" rel="noreferrer">Installing a Test Certificate on a Test Computer</a></li>
  <li><a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff553563(v=vs.85).aspx" rel="noreferrer">Using CertMgr to Install Test Certificates on a Test Computer</a></li>
  </ul>