Install/update driver from Windows service

2
votes

To install a driver, you typically send the command:

DefaultInstall 128 {inf path}

to the InstallHinfSection via direct call or RunDLL.

This works wonderfully. I can install my driver anywhere (including 64-bit Win 2008 R2, which means I've got all the code signing right too).

HOWEVER, the above fails when launched from a Windows service. I've read about service vs client installs, and hoped I had met all the requirements for a silent service install (built a .CAT file, it is signed along with the driver, etc).

But no dice - it just fails. Comparing the errors in SetupAPI.log between an interactive install and the install from the service doesn't show any differences (other than the interactive takes the steps of copying the driver file and succeeds, where the other doesn't).

The driver itself is not in use (my service is the only one that uses it). Is there ANY way for a service to silently update a driver without requiring user interaction?

1
windowsservicewindows-servicesinstallationdriver
We do the same thing from a service and it works fine; this is calling the API directly, not via rundll32. - Luke
Really? I've tried launching rundll32 and calling the API with the same results. What OS are you running on? What type of driver is getting installed? - DougN
Actually, we are using both methods. On 32-bit machines we call the API directly; on 64-bit machines we invoke it via rundll32 (we have a 32-bit installer). This is for a file system mini-filter on Vista and above. - Luke
Everything works well from my installer (when a user runs it). But not if the running service launches the installer silently in the background to update itself (ie running as a non-interactive service, in a different WinStation). Do you do that, and it works? - DougN
Our driver is installed on demand in the context of a service running as LocalSystem; it is not an installer per se. Maybe that is where the problem lies. We have a DLL that exposes a Start() function. That function is invoked from a service running as LocalSystem. If the driver is not installed, the Start() function will install it via the InstallHinfSection() API. - Luke

1 Answers

4
votes

I called Microsoft and discussed this with a support engineer.

Turns out that using DefaultInstall with InstallHinfSection is somewhat obsolete, but still works. And it just happens to work without prompting the user if the driver is signed by a certificate that they recognize because DefaultInstall is 'dumb'. Yet the driver itself is still allowed to launch because it's cross-signed with the Microsoft cert. A nice little loop-hole I guess. The trick is it has to be installed by a service that is set to Interact with Desktop (a requirement). Using something like PsExec or RemCom is a way to do this if your service isn't currently running in that way.

In the future, this might not continue to work. At that point, get the driver's .cat file into the Windows\System32\Catroot{F7... folder but it can't just be copied directly in -- there is an API.

If the .cat was put in first, then the driver theoretically shouldn't need to prompt to ask if the certificate for the driver is acceptable to the user, because catroot is the 'acceptable to the user' list of certs and drivers.

Also, having the catalog file installed before attempting the driver install might help since the catalog contains the security certificate that the driver will present (though not necessarily in this case -- but it might help in the future (and possibly with Win 2003)

Basically the support engineer was surprised this worked at all and we went around and around on how it might be working... Hopefully this helps someone else.