MS toaster sample and driver signing

When a new toaster device is plugged-in ( using command: enum.exe â??p 1 )
device Setup pops-up a warning that the driver is not properly signed.

Question 1. If I use remote desktop the warning message is displayed not on
my screen but on the primary or main screen and is not visible to me. I have
to login from a monitor which is physically connected to the machine where
toaster software runs in order to see this warning dialog and continue the
driver installation. Any suggestions how to deal with this problem without
passing WHQL tests? The workaround known to me is: go to Device Manager, find
the newly created toaster device, select Update Driver and go through the
installation process from the very beginning.

Question 2. After installing the driver for toaster device number 1 I want
to add toaster device number 2. Same warning message pops-up again. I already
approved the driver installation for device number 1 and device number 2 will
use the same driver. How to avoid the warning if the driver has been
previously installed for another device?

mirage2k2
Wed Oct 11 02:45:02 CDT 2006

Go to System Properties\Hardware\Driver Signing and check Ignore.

"BorisErl" wrote:

> When a new toaster device is plugged-in ( using command: enum.exe â??p 1 )
> device Setup pops-up a warning that the driver is not properly signed.
>
> Question 1. If I use remote desktop the warning message is displayed not on
> my screen but on the primary or main screen and is not visible to me. I have
> to login from a monitor which is physically connected to the machine where
> toaster software runs in order to see this warning dialog and continue the
> driver installation. Any suggestions how to deal with this problem without
> passing WHQL tests? The workaround known to me is: go to Device Manager, find
> the newly created toaster device, select Update Driver and go through the
> installation process from the very beginning.
>
> Question 2. After installing the driver for toaster device number 1 I want
> to add toaster device number 2. Same warning message pops-up again. I already
> approved the driver installation for device number 1 and device number 2 will
> use the same driver. How to avoid the warning if the driver has been
> previously installed for another device?
>

BorisErl
Wed Oct 11 18:11:02 CDT 2006

Changing driver signing policy on the machine can not be offered to end
users. I have not MS toaster but a completely different driver in production.
I used MS toaster sample in the original post only to make the description of
the problem as simple as possible. Of cause the right way is to get the
driver certified by MS but it requieres certification of some related
hardware from a third party company and is not visible at the moment.

"mirage2k2" wrote:

> Go to System Properties\Hardware\Driver Signing and check Ignore.
>
> "BorisErl" wrote:
>
> > When a new toaster device is plugged-in ( using command: enum.exe â??p 1 )
> > device Setup pops-up a warning that the driver is not properly signed.
> >
> > Question 1. If I use remote desktop the warning message is displayed not on
> > my screen but on the primary or main screen and is not visible to me. I have
> > to login from a monitor which is physically connected to the machine where
> > toaster software runs in order to see this warning dialog and continue the
> > driver installation. Any suggestions how to deal with this problem without
> > passing WHQL tests? The workaround known to me is: go to Device Manager, find
> > the newly created toaster device, select Update Driver and go through the
> > installation process from the very beginning.
> >
> > Question 2. After installing the driver for toaster device number 1 I want
> > to add toaster device number 2. Same warning message pops-up again. I already
> > approved the driver installation for device number 1 and device number 2 will
> > use the same driver. How to avoid the warning if the driver has been
> > previously installed for another device?
> >

mirage2k2
Wed Oct 11 20:31:02 CDT 2006

For end users you should get your driver signed. If the end users are
testers/partners, etc. you might be able to get them to change the signing
policy on test machines.

I had this problem before our driver was signed and it was a REAL problem.
If at any stage during the install of an NDIS IM driver you click "no" or
"dont install" (or whatever) on one of those warning dlgs the install would
fail and the system would blue screen! The system was left in such a bad
state that a lot of registry hacking, etc. was required to fix it. Perhaps
MS have fixed this now. What is the point of giving end user the option to
not install an unsigned driver, if when they take the option they end up with
a trashed system!

Here is an option that you might want to check out with MS. In your
installer YOU warn the user that the driver is unsigned and, if they agree to
continue with the install, then your installer temporarily sets the signing
policy on the target system to ignore. This way you are in control and
Windows doesn't completely screw up your installation.

"BorisErl" wrote:

> Changing driver signing policy on the machine can not be offered to end
> users. I have not MS toaster but a completely different driver in production.
> I used MS toaster sample in the original post only to make the description of
> the problem as simple as possible. Of cause the right way is to get the
> driver certified by MS but it requieres certification of some related
> hardware from a third party company and is not visible at the moment.
>
> "mirage2k2" wrote:
>
> > Go to System Properties\Hardware\Driver Signing and check Ignore.
> >
> > "BorisErl" wrote:
> >
> > > When a new toaster device is plugged-in ( using command: enum.exe â??p 1 )
> > > device Setup pops-up a warning that the driver is not properly signed.
> > >
> > > Question 1. If I use remote desktop the warning message is displayed not on
> > > my screen but on the primary or main screen and is not visible to me. I have
> > > to login from a monitor which is physically connected to the machine where
> > > toaster software runs in order to see this warning dialog and continue the
> > > driver installation. Any suggestions how to deal with this problem without
> > > passing WHQL tests? The workaround known to me is: go to Device Manager, find
> > > the newly created toaster device, select Update Driver and go through the
> > > installation process from the very beginning.
> > >
> > > Question 2. After installing the driver for toaster device number 1 I want
> > > to add toaster device number 2. Same warning message pops-up again. I already
> > > approved the driver installation for device number 1 and device number 2 will
> > > use the same driver. How to avoid the warning if the driver has been
> > > previously installed for another device?
> > >

chris
Wed Oct 11 20:44:53 CDT 2006

mirage2k2 wrote:

> installer YOU warn the user that the driver is unsigned and, if they agree to
> continue with the install, then your installer temporarily sets the signing
> policy on the target system to ignore.

Unfortunately, this is only accomplished (on XP and later) through some
rogue code that I personally have not gotten to work very reliably.

mirage2k2
Wed Oct 11 21:33:01 CDT 2006

there is the option of sending windows messages to the warning dialogues to
close them ... but this would be dodgy and I dont think MS would approve.

"chris.aseltine@gmail.com" wrote:

> mirage2k2 wrote:
>
> > installer YOU warn the user that the driver is unsigned and, if they agree to
> > continue with the install, then your installer temporarily sets the signing
> > policy on the target system to ignore.
>
> Unfortunately, this is only accomplished (on XP and later) through some
> rogue code that I personally have not gotten to work very reliably.
>
>

BorisErl
Thu Oct 12 01:33:01 CDT 2006

Well, the proposals are talking about â??how to get around the build in
security for unsigned driver installationâ??.

I actually tried to ask a different thing but probably did not explain it
clear enough. My question is this: letâ??s assume the admin plugged in device
â??toaster1â?? and installed a driver which did not pass MS certification for
this device. During the installation the admin was warned but accepted the
risk by clicking the â??Install anywayâ?? button on the warning screen displayed
by Found New Hardware Wizard. Now the admin plugs in device â??toaster2â?? which
has same HW ID and compatible ID as device â??toaster1â??. Is there any way for a
driver developer to suppress repetitive Setup warning and force the system to
use the driver which has been authorized and installed by the admin for
â??toaster1â???


"mirage2k2" wrote:

> there is the option of sending windows messages to the warning dialogues to
> close them ... but this would be dodgy and I dont think MS would approve.
>
> "chris.aseltine@gmail.com" wrote:
>
> > mirage2k2 wrote:
> >
> > > installer YOU warn the user that the driver is unsigned and, if they agree to
> > > continue with the install, then your installer temporarily sets the signing
> > > policy on the target system to ignore.
> >
> > Unfortunately, this is only accomplished (on XP and later) through some
> > rogue code that I personally have not gotten to work very reliably.
> >
> >

Eliyas
Thu Oct 12 09:17:17 CDT 2006

> Is there any way for a
> driver developer to suppress repetitive Setup warning and force the system
> to
> use the driver which has been authorized and installed by the admin for
> 'toaster1'?
>
>

No not on XP and Server 2003. Win2K would prompt only once. I don't know
about Vista.

-Eliyas

mirage2k2
Thu Oct 12 21:10:02 CDT 2006

What is MS view on this topic ...

The developer, by some means or another, warns the user a driver is unsigned
giving them the option to not install ... and then, by whatever method,
disables the built in system checking?

On another note; I have found that the presence of MS Packet Scheduler on a
system causes the installation of NDIS IM drivers to be unstable, so in the
installation of my IM driver I first uninstall MS Packet Scheduler so that my
install does not break the users system. How does MS view this type of thing?

"Eliyas Yakub [MSFT]" wrote:

> > Is there any way for a
> > driver developer to suppress repetitive Setup warning and force the system
> > to
> > use the driver which has been authorized and installed by the admin for
> > 'toaster1'?
> >
> >
>
> No not on XP and Server 2003. Win2K would prompt only once. I don't know
> about Vista.
>
> -Eliyas
>
>
>

Pavel
Sat Oct 14 00:03:57 CDT 2006

"mirage2k2" <mirage2k2@discussions.microsoft.com> wrote in message news:193FB219-74AC-405B-B5CC-8B1FE43BC7B6@microsoft.com...
> On another note; I have found that the presence of MS Packet Scheduler on a
> system causes the installation of NDIS IM drivers to be unstable, so in the
> installation of my IM driver I first uninstall MS Packet Scheduler so that my
> install does not break the users system. How does MS view this type of thing?

The Packet Scheduler is a IM driver. So it can interfere with other IM drivers,
like any 3rd party IM would do.
Sounds surprising?

--PA