Failure to install NCAP 0.9996 Unknown error! 4a020

[dashwell]

On installing ncap on Windows Server 2012 R2. Installation goes fine till installing the service. It then fails with the following error unable to install service...
Output folder: C:\Users\Admin\AppData\Local\Temp\nsh205B.tmp
Extract: NPFInstall.exe
Output folder: C:\Program Files\Npcap
Extract: LICENSE
Extract: DiagReport.bat
Extract: DiagReport.ps1
Extract: FixInstall.bat
Output folder: C:\Program Files\Npcap
Extract: Uninstall.exe
Extract: NPFInstall.exe
Output folder: C:\Program Files\Npcap
Extract: npcap.sys
Extract: npcap.cat
Extract: npcap.inf
Extract: npcap_wfp.inf
Installing NDIS6.x x64 driver for Win7, Win8 and Win10
Output folder: C:\Windows\system32
Extract: wpcap.dll
Extract: Packet.dll
Extract: NpcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\Windows\system32\Npcap
Extract: wpcap.dll
Extract: Packet.dll
Extract: NpcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\Windows\system32
Extract: wpcap.dll
Extract: Packet.dll
Extract: NpcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\Windows\system32\Npcap
Extract: wpcap.dll
Extract: Packet.dll
Extract: NpcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\Users\Admin\AppData\Local\Temp\nsh205B.tmp
Extract: Insecure-EV.cer
TrustedPublisher "Trusted Publishers"
Related Certificates:

Exact match:
Element 1:
Serial Number: 09256314069e7e6a88cb823075c0d9c9
Issuer: CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
NotBefore: 5/1/2020 2:00 AM
NotAfter: 5/7/2021 2:00 PM
Subject: CN=Insecure.Com LLC, O=Insecure.Com LLC, L=Seattle, S=Washington, C=US, SERIALNUMBER=200010310013, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US
Non-root Certificate
Cert Hash(sha1): 4c e8 97 94 fe 2d 2f 7e 30 12 1f 10 bc f7 6a c3 cc f7 7c a9

Certificate "Insecure.Com LLC" already in store.
CertUtil: -addstore command completed successfully.
Delete file: C:\Users\Admin\AppData\Local\Temp\nsh205B.tmp\Insecure-EV.cer
Output folder: C:\Users\Admin\AppData\Local\Temp\nsh205B.tmp
Extract: Insecure-EV-sha1.cer
TrustedPublisher "Trusted Publishers"
Related Certificates:

Exact match:
Element 3:
Serial Number: 0ea33b42058f115cf22cad9a60251ed4
Issuer: CN=DigiCert EV Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
NotBefore: 5/1/2020 2:00 AM
NotAfter: 5/7/2021 2:00 PM
Subject: CN=Insecure.Com LLC, O=Insecure.Com LLC, L=Seattle, S=Washington, C=US, SERIALNUMBER=200010310013, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US
Non-root Certificate
Cert Hash(sha1): 29 ba ca e8 98 85 2a ab 0b b9 16 28 81 05 3b 70 3b 9d 10 05

Certificate "Insecure.Com LLC" already in store.
CertUtil: -addstore command completed successfully.
Delete file: C:\Users\Admin\AppData\Local\Temp\nsh205B.tmp\Insecure-EV-sha1.cer
Clearing Npcap entries from driver store
Npcap driver cache in Driver Store has been successfully cleaned up!
Installing WFP callout driver
Npcap WFP callout driver has been successfully installed!
Installing NDIS filter driver
Unknown error! 4a020
Npcap LWF driver has failed to be installed.
Failed to create the npcap service for Win7, Win8 and Win10
Delete file: C:\Program Files\Npcap\Uninstall.exe

[emikg777]

Same error as here. Installer give error that LWF driver has failed to be installed(0x0004a020). There was 0.9991 version before, I uninstalled it(with install/uninstall program in Control Panel), after this I tried to install the newest version(0.9997) but catched this error
OS: Windows 7
Screenshot

Here are logs
DiagReport-20200826-171527.txt
install.log
setupapi.dev.log
NPFInstall.log
And one more thing, if you will scorll to the end in NFPInstall.log file, you can find this:
[000013F8] 2020-08-26 17:16:18 executeCommand: executing, strCmd = pnputil.exe -d
oem18.inf.
[000013F8] 2020-08-26 17:16:18 executeCommand: result = Служебная программа PnP Майкрософт

Не удалось удалить пакет драйвера:Синтаксическая ошибка в имени файла, имени папки или метке тома.

It is say that It can't delete the driver because syntax error in name file, so it'can't uninstall driver. Only I can delete oem18.inf with comand pnputil -d oem18.inf (with admin rights). I can guess this is error with concatenation string(or something else), I think problem with unnecessary enter. If I delete oem18.inf problem still appears.

[dmiller-nmap]

Thanks for this report. The error "4a020" is NETCFG_E_ALREADY_INITIALIZED. This has been reported previously as nmap/nmap#1307, and the resolution there was to either install without the raw 802.11 WiFi frame capture support. Please perform the following procedure to ensure a clean installation and report if the issue persists:

1. Uninstall Npcap.
2. Reboot.
3. Install Npcap 0.9997

@emikg777 your analysis of the pnputil error message is correct; I get the same error in English if I try injecting a newline character in PowerShell, e.g. pnputil -d "noem45.inf"`. I've pushed a change for that part of this issue.

[guyharris]

Should the installer map NETCFG_E_ALREADY_INITIALIZED - and other NETCFG_ return codes - to messages?

[emikg777]

@dmiller-nmap Hello I successfully installed Npcap. There is no difference between I install with raw 802.11 WiFi frame or not. I tested with, I tested without... no result. Then I go to your link and find solution:
Admin Templates\System\Device Installation\Device Installation Restrictions\Prevent Installation of devices using drivers that match these device setup classes.
I disable this and entered gpupdate /force in cmd(with admin rights). And After this I successfully installed Npcap.... But this isn't end... I think I must fully uninstall npcap, reboot and install it again(to be sure that I haven't problem in future)...... Spoiler: there was stupid idea, very stupid. After then I have same error 4a020..... So I think what I did in past... And remembered that I have instaled 0.9991 version of Npcap yesterday, but it same give the error(same 4a020)... And I install 0.9991 version it give error, then I used pnputil to delete oem18.inf, after reboot computer. And only after this I can install 0.9997 version of Npcap. I don't know this is coincidence or greate random.... But I afraid to uninstall now Npcap and experemente with it. I only can suggest that something doing 0.9991 installer(or uninstalller, because after I catch error programm immediatly call uninstaller) that doesn't doing 0.9997 installer(or uninstaller), I saw that 09991 installer give error when clear driver chache, and 0.9997 installer give error when install NDIS filter driver. Sorry for pure information this is all what I noticed.
My solution to resolve problem:

1. Edit Group Policy(Disable this -> Computer Configuration\Admin Templates\System\Device Installation\Device Installation Restrictions\Prevent Installation of devices using drivers that match these device setup classes). I also Disable all Polices in same folder which restrict installation devices(But I do't know have this effect or no)
2. gpupdate /force
3. Reboot
4. Install 0.9991 installer
5. Catch error
6. Delete all nmap oem files( use to search it pnputil -e; then delete they with pnputil -d)
7. Reboot
8. Install 0.9997.
9. ? (Profit)

[dmiller-nmap]

@emikg777 Thanks for letting us know what worked for you. What device setup classes were restricted before? Do you have a screenshot or other description of what policies in that directory/folder were configured?

@guyharris It might be helpful to map these to messages, but in most cases the messages aren't very informative. Instead, I've made a change in 0.9997 to display the error code in the messagebox directly, and I will be documenting some of the more common ones that are out of our control. For these, I may map to helpful messages within the installer, but for the most part failures of this sort have been eliminated.

[emikg777]

@dmiller-nmap Hello, I don't know what device setup classes were restricted before, because this parameter was undefined... But only after I change it to Disable I has possibility to install Npcap. I can send screnshot, but I don't know can it helps you, because it is in Russian language....

I disabled three parameters in path -> Computer Configuration\Admin Templates\System\Device Installation\Device Installation Restrictions\

1. Prevent Installation of devices using drivers that match these device setup classes(It 100% has effect, because after I disabled it, I can install Npcap), other policy I disabled to be sure that I haven't problem in future
2. Prevent Installation of devices using drivers that match any of these device IDs(I don't know have this any effect)
3. Prevent Installation of devices using drivers not describes by other policy settings(I don't know have this any effect)

It's all what I can say... If you can please fix this. I think this error occur only if you uninstall old version of Npcap and then install new version of Npcap(and I think it only occur on old OS).

[Boilerplate4u]

Got the same problem on WinSrv 2012r2. Any final solution yet on what causes the issue and how to solve it? I've tested both 0.9991 and 0.9997 with the same outcome.

[dmiller-nmap]

My initial analysis was incorrect: the error for NETCFG_E_ALREADY_INITIALIZED is 0x8004a020. This error is 0x0004a020, which is NETCFG_S_REBOOT. The "S" part and the fact that the high-order bit is not set indicates that it is not a failure but an extended success code. We will be addressing this in the next release by setting the Reboot flag in the installer, which will prompt for a reboot after the installation finishes. Related commits are 8d79ffb and nmap/npcap-build@fc0cec2575f8371403cf1c7a808b8086d551b66b

[kong62]

windows 2012 r2 ok:

windows 2012 r2 + vpn bad:

[dmiller-nmap]

Npcap installer for version 1.55 will not treat this condition as a failure, but will instead prompt the user to reboot. For Npcap OEM licensees using silent mode, the installer return value will be ERROR_SUCCESS_REBOOT_REQUIRED (3010) and the system will require a reboot before Npcap can be used. This is still an unusual situation; most installations will succeed without a reboot.