Legacy boot driver not loading on 2008 x64 R2

NTFSD
1

Any ideas why a properly signed legacy boot driver would not load on a
couple of Windows 2008 x64 R2 machines? (Event ID 7026 in System Log.)
DriverEntry is not even being called.

It is working fine on any other 2008 x64 R2 machine we have tried them on.

The problem machines have Symantec Endpoint Protection: does SEP now stop
boot drivers from starting under certain circumstances?

Any suggestions as to what to look at would be appreciated.

2

Can you load it manually? (regardless of whether it functions, the main issue is whether DriverEntry is called).

If a driver fails to load on Vista/7/2008/08_R2, the system does not boot either. So it is probably something
mixing up the registry keys.

Deja.

Neil Weicher wrote:

Any ideas why a properly signed legacy boot driver would not load on a
couple of Windows 2008 x64 R2 machines? (Event ID 7026 in System Log.)
DriverEntry is not even being called.

It is working fine on any other 2008 x64 R2 machine we have tried them on.

The problem machines have Symantec Endpoint Protection: does SEP now stop
boot drivers from starting under certain circumstances?

Any suggestions as to what to look at would be appreciated.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

3

If you are using test certificate to sign the driver and forget to do bcdedit set testsigning on. It may cause not to load your driver.

4

Have your tried enabling boot logging? I’m not sure what it will really
tell you, but you never know.

Bcdedit bootlog on

Good luck,

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@mindtree.com
Sent: Monday, December 06, 2010 6:51 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Legacy boot driver not loading on 2008 x64 R2

If you are using test certificate to sign the driver and forget to do
bcdedit set testsigning on. It may cause not to load your driver.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

Good suggestion. They tried doing a NET START and got this message:

System error 1058 has occurred.
The service cannot be started, either because it is disabled or because it
has no enabled devices associated with it.

“Dejan Maksimovic” wrote in message news:xxxxx@ntfsd…
>
> Can you load it manually? (regardless of whether it functions, the main
> issue is whether DriverEntry is called).
>
> If a driver fails to load on Vista/7/2008/08_R2, the system does not
> boot either. So it is probably something
> mixing up the registry keys.
>
> Deja.
>
> Neil Weicher wrote:
>
>> Any ideas why a properly signed legacy boot driver would not load on a
>> couple of Windows 2008 x64 R2 machines? (Event ID 7026 in System Log.)
>> DriverEntry is not even being called.
>>
>> It is working fine on any other 2008 x64 R2 machine we have tried them
>> on.
>>
>> The problem machines have Symantec Endpoint Protection: does SEP now stop
>> boot drivers from starting under certain circumstances?
>>
>> Any suggestions as to what to look at would be appreciated.
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule of debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>
> –
> Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
>
>

6

So check Start value?

Neil Weicher wrote:

Good suggestion. They tried doing a NET START and got this message:

System error 1058 has occurred.
The service cannot be started, either because it is disabled or because it
has no enabled devices associated with it.

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.