Microsoft Message Anlayzer 1.4 - 'A Digitally Signed Driver Is Required' RRS feed

All replies

  • We tried to reproduce this using Windows 10 1607.  Is that similar to your setup?

    Have you tried to reproduce on multiple machines?



    Wednesday, October 5, 2016 1:35 PM
  • Completely clean installation of 1607, using an image created with the Window Media Creation Tool.

    As per the above link regarding new Driver Signing changes in Windows 10 1607, did you try to reproduce it under the following conditions?

    - Clean install of 1607 (not update to 1607)
    - Secure boot switched ON

    Wednesday, October 5, 2016 6:18 PM
  • Yes, we were able to repro with SecureBoot enabled.  We are looking at this now and post a new build when we have this fixed.  But I don't have a time frame. 


    Thursday, October 13, 2016 1:08 PM
  • Disabling SecureBoot resolved it for me as well. Two months in I would have expected you'd add that to the Known Issues document.
    Friday, December 16, 2016 12:14 PM
  • Still not fixed?

    ________________ drahnier

    Monday, January 30, 2017 6:12 PM
  • Still not fixed.... I just ran into as well on my Surface Book 1607 - build 14393.693

    Sunday, February 5, 2017 8:31 PM
  • Still not fixed. I have Secure Boot enabled as well.
    Thursday, February 23, 2017 3:57 PM
  • Also just had this same issue.
    Friday, February 24, 2017 4:47 PM
  • Still has the same issue.
    Tuesday, February 28, 2017 3:29 PM
  • same issue

    Mitch Roberson MCM Exchange 2010|MCITP:Enterprise Server Admin, Messaging 2007, 2010 |MCTS:OCS with Voice Achievement |MCT |MCSE 2000\2003 |MCSE Messaging 2000\2003

    Monday, March 6, 2017 7:18 PM
  • It's the dumbest error I've ever seen - to treat own signed driver as unsigned. Because of that you'll have PEF-WFP-MessageProvider unworking.
    Monday, March 6, 2017 7:24 PM
  • This is still an issue in Message Analyzer 1.4 build 4.0.8112.0.

    Wednesday, July 5, 2017 9:33 PM
  • Still working in 1703 (even Insider Preview will do). Disabling secure boot still resolves the issue. Security is secure yet.

    Сквозь сиреневый дым...

    Thursday, July 20, 2017 10:42 PM
  • Still an issue 9 months later. This makes it very difficult to collect traces if we need to do it in NON test environments where secure boot may be required.
    Tuesday, August 8, 2017 4:13 PM
  • Still broken on Win10 1703. 

    Disabling Secure Boot not an option.

    is there a fix?

    what functionalities of Message Analyzer are affected because of this issue.


    Friday, August 18, 2017 5:48 PM
  • Hello,

    I am exercising this bug as well attempting to use Microsoft Message Analyzer v1.4 Build 4.0.8112.0 on Windows 10 Enterprise v1703 Build 15063.540.  Is an ETA for a fix known?


    Aryeh Goretsky

    Aryeh Goretsky - Microsoft MVP - Desktop Experience

    Monday, September 4, 2017 1:44 AM
  • Still an issue a year later.

    Tuesday, November 7, 2017 1:23 AM
  • Hey Microsoft - great job!!!!
    Monday, November 13, 2017 11:16 AM
  • See following note at this site: https://technet.microsoft.com/en-us/library/dn904558.aspx

    If you are installing Message Analyzer on a Windows 10 computer, the Windows Filtering Platform (WFP) message provider (Microsoft-PEF-WFP-MessageProvider) is installed as part of the operating system; therefore, the Message Analyzer installer (.msi) no longer installs this component. However, for all other supported down-level computers, such as Windows 8, the WFP message provider is installed with the Message Analyzer .msi application that you run from the download site. On Windows 10 computers, you can use this provider to conveniently capture traffic above the IP/Network Layer, which includes HTTP traffic, while removing lower-layer noise. Since the WFP provider is native to the Windows 10 operating system, you will not have to install any additional software to capture such traffic.

    Friday, November 17, 2017 1:52 PM
  • See following note at this site:

    And what? What useful information does it bring? We all reporting this bug on Win10, where WFP is installed natively. Treating native drivers as unsigned is dumb! DUMB AS HELL!
    Friday, December 8, 2017 9:11 AM
  • The installer is still attempting to install the driver. I don't know if it is because it just tries to install regardless of what the operating system has, or because it does not see it installed. Please review the install and publish an updated to properly work with the OS it is being installed on. Plus, please sign the driver, not sure why that is so complicated to get done for how long the installer has been out.  
    Thursday, January 4, 2018 3:52 PM
  • Same problem. Windows 10 Build 1709. 
    Thursday, March 1, 2018 1:29 PM
  • Hi, I've had the same problem on Win 10 1709. However, if you select No when the installer asks "Optimize Message analyzer for capturing" it installs without problem. I'm using it mostly to analyze captures from other systems, so it doesn't matter much to me I guess...
    Thursday, March 15, 2018 2:52 PM
  • I have Win 10 1709, and tried selecting "No" as per your suggestion.  No luck.  I still get the "Signed Driver Is Required" message.  Message Analyzer doesn't work correctly after that, so I'll have to find another tool.  Very disappointing.

    Jerry Dixon

    Thursday, April 5, 2018 3:22 PM
  • Win10 1709; Message Analyzer 1.4 Build 4.0.8112.0

    Fixed by ...

    • Disabling Secure Boot
    • Selecting "No" during installation when you get prompted for "Optimize Message analyzer for capturing"

    Dumpy bug -.- Good luck everyone facing this issue!

    Thank for the hints!


    Wednesday, April 18, 2018 7:27 PM
  • The WfpCapture driver fell foul of the Driver Signing changes in Windows 10, version 1607. Unless one or more of the exception conditions of the signing policy apply (i.e. Secure Boot is disabled or the installed Windows version was upgraded from an earlier release of Windows (rather than being a “clean” install)), then this WFP callout driver cannot be used. Microsoft have acknowledged the problem in this thread (on Thursday, October 13, 2016) but have since done nothing – which does not bode well for the future of Message Analyzer.


    The changes to the Driver Signing Policy were discussed at a 2016 Filter Plugfest (video available on Channel 9) and Scott Anderson from Microsoft mentioned four exceptions to the policy – the three currently documented exceptions and a “test reg key to allow cross-signed certificates to work”. Peter Viscarola (founder of OSR) later wrote, in response to a discussion of this topic:


    I hate to say this, but since you asked: The registry key information is only available under NDA.


    I can’t find any other useful information about this key, but it does seem possible to keep Secure Boot enabled and use WfpCapture on a clean install via a different approach – making it seem as though Windows was upgraded rather than cleanly installed.


    The “upgraded” system exception to the driver signing policy is signalled by a registry value in the Code Integrity (CI) Policy key. The driver signing policy is slowly being tightened; future releases will first only allow exceptions for “boot start” drivers before finally removing all exceptions.



        BootUpgradedSystem    REG_DWORD    0x1

        UpgradedSystem        REG_DWORD    0x1


    Gary Nebbett

    Saturday, June 30, 2018 8:15 AM
  • Jul 2018. Still issue with Win10 v1607 needing a digitally signed driver.

    Turning off the "Optimize Message analyzer for capturing" during application installation didn't work. Can't disable secure boot mode due to company AD security policy preventing it.

    Bummer. Wanted to use Message Analyzer to view output from netstat. Will use Wireshark instead

    Wednesday, July 4, 2018 11:28 PM
  • Just wanted to bump and let you guys know that this is still an issue.
    Tuesday, September 3, 2019 7:52 AM