npcap not working after Windows Update

[io8titan]

I am using npcap 0.93 together with Windows 10 x64 Insider builds.
Whenever I Windows updates to a new build, npcap is not working anymore
(Wireshark doesn't display any interfaces). Reinstalling npcap though fixes the issue.

[dmiller-nmap]

I thought we had addressed an issue like this (#906) in Npcap 0.93, which was the result of Windows version upgrades deleting our non-standard service registry keys. Can you run DiagReport when Npcap is not working and provide the output here? This should help us identify what is going wrong.

[io8titan]

Only needed to update Windows today, and again Npcap is not working without a reinstall.
This is the output while Npcap was not working:
DiagReport-20170913-233505.txt

[dmiller-nmap]

The DiagReport output looks good except that it appears the Npcap driver service has been changed to Manual start. It is possible to install Npcap this way, though it is not the default. Can you start the service by running (as administrator): net start npcap

If this succeeds, try running Wireshark again. Please let us know whether the service starts and whether Wireshark is able to see interfaces. If it works, you can set it to start automatically instead: sc.exe config npcap start= auto

[dmiller-nmap]

I found that we were setting the Start registry value under the Parameters subkey instead of directly under the npcap service registry key, which is incorrect. However, I do not believe this prevented other procedures from setting it properly later in the install process, so fixing this should not have any impact on this issue.

Also, I have a correction: the start value we intend to set is not auto, but system. It is possible that it should be auto, but I am still researching this.

[io8titan]

A net start npcap and sc.exe config npcap start= auto will solve the issue, but I guess only until the next Windows update when it will be resetted to manual again...
Hope you can find a lasting fix.

[dmiller-nmap]

I'm glad to hear that this is the only thing that is changing; that makes it easier to track down a fix.

I did more research on the start value: it appears that "SYSTEM" is what we want because Windows Vista and 7 prevent the whole network stack from loading for 90 seconds if an optional filter (like Npcap) is not present (i.e. started) when it tries to start. So setting SYSTEM start makes sure that Npcap is ready before the network starts.

Hope to learn soon why Windows is changing this value on us.

[dmiller-nmap]

I found this thread related to NDIS drivers failing after upgrading Windows versions: http://www.osronline.com/ShowThread.cfm?link=249473

Jeffrey Tippet of Microsoft says:

An NDIS protocol driver gets registered with two databases: the SCM driver
service database and the NetCfg network driver database. SCM is responsible for
starting the driver, and NetCfg is responsible for creating bindings to NICs.
(These separate databases are also why installation requires two steps:
SetupCopyOEMInf and INetCfgClassSetup::Install -- one step for each database.)

Windows migrates the SCM driver database during an OS upgrade, but does not
migrate the NetCfg network driver database during an OS upgrade. Therefore,
after an OS upgrade, you will see that the driver is still registered with SCM,
and still gets its DriverEntry called, but NDIS won't attempt to bind your
protocol to any NICs.

This is not specific to your driver; it's true of all NDIS protocol drivers.
The best workaround is to have your usermode app detect that the driver got
uninstalled, and to call INetCfgClassSetup::Install again.

Documenting this here in case we decide to implement this.

Confirming this is still an issue as of Windows 10 Insider Preview 19013. A workaround would be to have Wireshark detect if npcap isn't running and notify/start it instead of failing silently.

[oldium]

This time (currently on Insider build 19033) I just needed to run net start npcap and it started showing interfaces in Wireshark. So to me it looks like the auto-start of the service is disabled when doing Windows update. I will try to verify this (try not to forget actually) with next Insider build.

sc query npcap from Administrative command prompt shows this on fresh boot:

SERVICE_NAME: npcap
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

Exit code 1077 means: “No attempts to start the service have been made since the last boot.”

Edit: I just reinstalled npcap to know the wanted state. This is how the service looks like after fresh installation, in PowerShell Get-Service npcap | fl *:

Name                : npcap
RequiredServices    : {}
CanPauseAndContinue : False
CanShutdown         : False
CanStop             : True
DisplayName         : Npcap Packet Driver (NPCAP)
DependentServices   : {}
MachineName         : .
ServiceName         : npcap
ServicesDependedOn  : {}
ServiceHandle       : SafeServiceHandle
Status              : Running
ServiceType         : KernelDriver
StartType           : System
Site                :
Container           :

So lets wait for next insider build to check what changes.

[oldium]

After update:

Name                : npcap
RequiredServices    : {}
CanPauseAndContinue : False
CanShutdown         : False
CanStop             : False
DisplayName         : Npcap Packet Driver (NPCAP)
DependentServices   : {}
MachineName         : .
ServiceName         : npcap
ServicesDependedOn  : {}
ServiceHandle       : SafeServiceHandle
Status              : Stopped
ServiceType         : KernelDriver
StartType           : Manual
Site                :
Container           :

Problem is StartType - change from System to Manual. I will create a ticket via Feedback Hub, hopefully Microsoft can fix this. Another difference is the CanStop, which is False after update.

[grochoge]

I've seen weird issues like Explorer failing to start after using the sc config command to change startup with 0.9986. Reinstalling seemed to make things work better. Not sure if it's something with my system specifically.

Maybe set the security descriptor on the npcap service to allow everyone to start it (rather than just administrators) when non-admin access is enabled in the installer? Is that preserved when upgrading to a new version of Windows?

Something like:
sc sdset D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPLOCRRC;;;WD)