Our hba.sys (Fibre channel storage driver) signed using SHA256(Family of SHA-2). Since W2K8R2 OS doesn’t supports SHA-2, KB3033929 security update is needed.
Added KB3033929 update and hba.sys to an offline OS image (boot.wim and install.wim) using DISM tool. Now using dism /get-packages’ and ‘DISM.exe /get-drivers’ I confirmed that hba.sys and KB3033929 is injected into boot.wim and install.wim successfully.
The following is the experiment I did
Added boot.wim and install.wim in wds server.
Using PXE boot selected boot.wim. Now ‘Windows loading screen’ is seen Indefinitely. Tried installing with ‘Disable driver signature enforcement’ but this didn’t help.
I am guessing this is because of OS execution order priority. First boot critical drivers(hba.sys) then KB3033929 update code. Once boot critical driver (hba.sys) is loaded windows sees it’s signed by SHA-2 which is not supported by it, so ‘Windows loading screen’ is seen indefinitely.
Please someone clarify the below questions,
How can I confirm the OS execution order?
Once boot critical drivers is loaded then only KB3033929 security update will load and execute?
If problem is with signing algorithm, why ‘Disable driver signature enforcement’ doesn’t works?
In what all cases ‘Windows loading screen’ is seen indefinitely? How can I get out of this and succeed installation.
Thanks in advance. Please someone help me regarding the above …
I don’t understand your question/point about “OS execution order” at all… but ignoring that I think you need to hook up a debugger, enable boot debugging, and debug the problem. I mean, how else will you possibly know what’s going wrong? My only specific advice would be to remember to enable boot debugging (bcdedit /bootdebug on) in addition to regular debugging.
This will also bypass any signature issues, taking that whole nonsense out of the picture.
Our hba.sys is a storage driver. The thing I am trying is Win 2008 R2 OS installation on the LUN.
hba.sys is boot critical driver signed using sha2. The purpose of this driver is, it detects the LUN (storage) which is attached to the Host machine.
So to carry out OS Installation I am doing the following,
Using Dism tool added KB3033929 update and hba.sys to Win 2008 R2 OS offline image ( boot.wim and install.wim ).
Added the boot.wim and install.wim to wds server, then started OS installation.
Started PXE booting. Selected boot.wim, this boot.wim contains our hba.sys and KB3033929 update, If hba.sys gets loaded successfully my LUN will be visible so I can carry out OS installation.
The Problem I am facing is,
Once boot.wim is selected ‘windows loading screen’ is seen indefinitely.
I am doing OS Installation. To my understanding once OS gets installed, It can be made as debug OS and can be dubugged by configuring using bcdedit.
Or else is there any other way to make an offline os image, capable of being debug enabled, please guide me regarding this.
For “OS execution order” the thing I am trying to say is, during OS installation windows starts boot(load) critical drivers in an sequence order.
Consider a scenario like this,
After loading hba.sys, in a scenario like now KB3033929 update haven’t been loaded until now. In this case windows check this hba.sys which is signed using sha-2. The one which is not supported by Win 2008 R2 os. So there may be a chance of windows expects something and “windows loading screen” is seen indefinitely.
I assume, If a scenario like KB3033929 update loads first, then our hba.sys (boot start driver) is loded second. Now code part to support sha-2 is there, so hba.sys may gets succeeded in loading and the LUN can be visible, so I can carry out OS Installation in the LUN. Is there anyway to confirm this…?