[win12r2][netkvm]can't install 21500 netkvm

[bbbccvbvv]

Recently, while handling legacy workload migration, we need to migrate a batch of old Windows Server 2012 R2 instances to new instances. Since VirtIO drivers were not pre-installed, we manually installed them. However, after installing the 21500 netkvm driver, the network adapter became abnormal, as shown in the screenshot below.

The setupapi.dev.log is as follows:

error.log

Is there currently any workaround available?

[kostyanf14]

@bbbccvbvv Can you try the latest official release 285?

[bbbccvbvv]

@bbbccvbvv Can you try the latest official release 285?

the netkvm version in release 285 is 24000.also error.

setupapi.dev.log:>>> [Device Install (Hardware initiated) - PCI\VEN_1AF4&DEV_1000&SUBSYS_00011AF4&REV_00\4&1e394c99&0&0868] >>> Section start 2026/07/29 17:03:55.092 dvi: {Build Driver List} 17:03:55.097 dvi: Searching for hardware ID(s): dvi: pci\ven_1af4&dev_1000&subsys_00011af4&rev_00 dvi: pci\ven_1af4&dev_1000&subsys_00011af4 dvi: pci\ven_1af4&dev_1000&cc_020000 dvi: pci\ven_1af4&dev_1000&cc_0200 dvi: Searching for compatible ID(s): dvi: pci\ven_1af4&dev_1000&rev_00 dvi: pci\ven_1af4&dev_1000 dvi: pci\ven_1af4&cc_020000 dvi: pci\ven_1af4&cc_0200 dvi: pci\ven_1af4 dvi: pci\cc_020000 dvi: pci\cc_0200 dvi: Created Driver Node: dvi: HardwareID - PCI\VEN_1AF4&DEV_1000&SUBSYS_00011AF4&REV_00 dvi: InfName - C:\Windows\System32\DriverStore\FileRepository\netkvm.inf_amd64_fc5312c12aaa4b7d\netkvm.inf dvi: DevDesc - Red Hat VirtIO Ethernet Adapter dvi: Section - kvmnet6.ndi dvi: Rank - 0x80ff0000 dvi: Signer Score - Not digitally signed dvi: DrvDate - 07/21/2023 dvi: Version - 63.93.104.24000 dvi: {Build Driver List - exit(0x00000000)} 17:03:55.105 dvi: {DIF_SELECTBESTCOMPATDRV} 17:03:55.106 dvi: No class installer for '以太网控制器' dvi: Using exported function 'WlanDeviceClassCoInstaller' in module 'C:\Windows\system32\wlaninst.dll'. dvi: CoInstaller 1 == wlaninst.dll,WlanDeviceClassCoInstaller dvi: Using exported function 'WwanDeviceClassCoInstaller' in module 'C:\Windows\system32\wwaninst.dll'. dvi: CoInstaller 2 == wwaninst.dll,WwanDeviceClassCoInstaller dvi: CoInstaller 1: Enter 17:03:55.110 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.110 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.111 dvi: {Select Best Driver} dvi: Class GUID of device changed to: {4d36e972-e325-11ce-bfc1-08002be10318}. dvi: {DIF_DESTROYPRIVATEDATA} 17:03:55.111 dvi: CoInstaller 1: Enter 17:03:55.112 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.112 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.113 dvi: Default installer: Exit dvi: {DIF_DESTROYPRIVATEDATA - exit(0xe000020e)} 17:03:55.113 dvi: Selected: dvi: Description - [Red Hat VirtIO Ethernet Adapter] dvi: InfFile - [c:\windows\system32\driverstore\filerepository\netkvm.inf_amd64_fc5312c12aaa4b7d\netkvm.inf] dvi: Section - [kvmnet6.ndi] dvi: {Select Best Driver - exit(0x00000000)} dvi: Default installer: Exit dvi: {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 17:03:55.114 ndv: {Core Device Install} 17:03:55.115 dvi: {DIF_ALLOW_INSTALL} 17:03:55.120 dvi: No class installer for 'Red Hat VirtIO Ethernet Adapter' dvi: Using exported function 'WlanDeviceClassCoInstaller' in module 'C:\Windows\system32\wlaninst.dll'. dvi: CoInstaller 1 == wlaninst.dll,WlanDeviceClassCoInstaller dvi: Using exported function 'WwanDeviceClassCoInstaller' in module 'C:\Windows\system32\wwaninst.dll'. dvi: CoInstaller 2 == wwaninst.dll,WwanDeviceClassCoInstaller dvi: CoInstaller 1: Enter 17:03:55.122 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.123 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.123 dvi: Default installer: Exit dvi: {DIF_ALLOW_INSTALL - exit(0xe000020e)} 17:03:55.123 dvi: {DIF_INSTALLDEVICEFILES} 17:03:55.124 dvi: No class installer for 'Red Hat VirtIO Ethernet Adapter' dvi: CoInstaller 1: Enter 17:03:55.124 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.125 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.126 dvi: Default installer: Exit dvi: {DIF_INSTALLDEVICEFILES - exit(0x00000000)} 17:03:55.126 flq: File 'C:\Windows\system32\DRIVERS\netkvm.sys' pruned from copy. ! sig: VerifyTrustFailed for C:\Windows\system32\DRIVERS\netkvm.sys. ! sig: Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. dvi: {DIF_REGISTER_COINSTALLERS} 17:03:55.146 dvi: No class installer for 'Red Hat VirtIO Ethernet Adapter' dvi: CoInstaller 1: Enter 17:03:55.147 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.147 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.147 dvi: {DIF_DESTROYPRIVATEDATA} 17:03:55.148 dvi: CoInstaller 1: Enter 17:03:55.148 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.148 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.148 dvi: Default installer: Exit dvi: {DIF_DESTROYPRIVATEDATA - exit(0xe000020e)} 17:03:55.149 dvi: Default installer: Exit dvi: {DIF_REGISTER_COINSTALLERS - exit(0x00000000)} 17:03:55.149 dvi: {DIF_INSTALLINTERFACES} 17:03:55.149 dvi: No class installer for 'Red Hat VirtIO Ethernet Adapter' dvi: Using exported function 'WlanDeviceClassCoInstaller' in module 'C:\Windows\system32\wlaninst.dll'. dvi: CoInstaller 1 == wlaninst.dll,WlanDeviceClassCoInstaller dvi: Using exported function 'WwanDeviceClassCoInstaller' in module 'C:\Windows\system32\wwaninst.dll'. dvi: CoInstaller 2 == wwaninst.dll,WwanDeviceClassCoInstaller dvi: CoInstaller 1: Enter 17:03:55.151 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.151 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.151 dvi: Default installer: Exit dvi: {DIF_INSTALLINTERFACES - exit(0x00000000)} 17:03:55.152 dvi: {DIF_INSTALLDEVICE} 17:03:55.152 dvi: No class installer for 'Red Hat VirtIO Ethernet Adapter' dvi: CoInstaller 1: Enter 17:03:55.152 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.153 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.153 dvi: {Install DEVICE} dvi: {Writing Device Properties} dvi: Strong Name=oem2.inf:b2fe48187dbc5606:kvmnet6.ndi:63.93.104.24000:pci\ven_1af4&dev_1000&subsys_00011af4&rev_00 dvi: {Writing Device Properties - Complete} inf: AddService=netkvm,2,kvmnet6.Service,kvmnet6.EventLog (netkvm.inf line 52) dvi: Add Service: Modified existing service 'netkvm'. dvi: {Install DEVICE exit (0x00000000)} dvi: Install Device: Starting device. 17:03:55.164 dvi: Install Device: Starting device completed. 17:03:55.370 !!! dvi: Device not started: Device has problem: 0x1f: CM_PROB_FAILED_ADD. dvi: Default installer: Exit dvi: CoInstaller 1: Enter (Post Processing) 17:03:55.373 !!! dvi: CoInstaller 1: failed(0x00000002)! (Post Processing) !!! dvi: Error 2: The system cannot find the file specified. dvi: {DIF_INSTALLDEVICE - exit(0x00000002)} 17:03:55.374 !!! ndv: Error(00000002) installing device! ! ndv: Queueing up error report since device installation failed... ndv: {Core Device Install - exit(0x00000002)} 17:03:55.378 dvi: {DIF_DESTROYPRIVATEDATA} 17:03:55.378 dvi: CoInstaller 1: Enter 17:03:55.378 dvi: CoInstaller 1: Exit dvi: CoInstaller 2: Enter 17:03:55.379 dvi: CoInstaller 2: Exit dvi: Default installer: Enter 17:03:55.379 dvi: Default installer: Exit dvi: {DIF_DESTROYPRIVATEDATA - exit(0xe000020e)} 17:03:55.380 <<< Section end 2026/07/29 17:03:55.477 <<< [Exit status: FAILURE(0x00000002)]

[kostyanf14]

looks like signature validation issue

     sig:                     {_VERIFY_FILE_SIGNATURE} 16:08:48.510
     sig:                          Key      = netkvm.inf
     sig:                          FilePath = C:\Windows\System32\DriverStore\Temp\{bf18daea-772c-2b45-8bc3-3758e2c33b47}\netkvm.inf
     sig:                          Catalog  = C:\Windows\System32\DriverStore\Temp\{bf18daea-772c-2b45-8bc3-3758e2c33b47}\netkvm.cat
!    sig:                          Verifying file against specific (valid) catalog failed! (0x800b0109)
!    sig:                          Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
     sig:                     {_VERIFY_FILE_SIGNATURE exit(0x800b0109)} 16:08:48.532
     sig:                     {_VERIFY_FILE_SIGNATURE} 16:08:48.532
     sig:                          Key      = netkvm.inf
     sig:                          FilePath = C:\Windows\System32\DriverStore\Temp\{bf18daea-772c-2b45-8bc3-3758e2c33b47}\netkvm.inf
     sig:                          Catalog  = C:\Windows\System32\DriverStore\Temp\{bf18daea-772c-2b45-8bc3-3758e2c33b47}\netkvm.cat
     sig:                          Success: File is signed in Authenticode(tm) catalog.
     sig:                          Error 0xe0000242: The publisher of an Authenticode(tm) signed catalog has not yet been established as trusted.
     sig:                     {_VERIFY_FILE_SIGNATURE exit(0xe0000242)} 16:08:48.553

this is old os and we cannot resign driver anymore
Please check netkvm.cat certificate and if it untrusted, add it manually to trusted store

[bbbccvbvv]

looks like signature validation issue

     sig:                     {_VERIFY_FILE_SIGNATURE} 16:08:48.510
     sig:                          Key      = netkvm.inf
     sig:                          FilePath = C:\Windows\System32\DriverStore\Temp\{bf18daea-772c-2b45-8bc3-3758e2c33b47}\netkvm.inf
     sig:                          Catalog  = C:\Windows\System32\DriverStore\Temp\{bf18daea-772c-2b45-8bc3-3758e2c33b47}\netkvm.cat
!    sig:                          Verifying file against specific (valid) catalog failed! (0x800b0109)
!    sig:                          Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
     sig:                     {_VERIFY_FILE_SIGNATURE exit(0x800b0109)} 16:08:48.532
     sig:                     {_VERIFY_FILE_SIGNATURE} 16:08:48.532
     sig:                          Key      = netkvm.inf
     sig:                          FilePath = C:\Windows\System32\DriverStore\Temp\{bf18daea-772c-2b45-8bc3-3758e2c33b47}\netkvm.inf
     sig:                          Catalog  = C:\Windows\System32\DriverStore\Temp\{bf18daea-772c-2b45-8bc3-3758e2c33b47}\netkvm.cat
     sig:                          Success: File is signed in Authenticode(tm) catalog.
     sig:                          Error 0xe0000242: The publisher of an Authenticode(tm) signed catalog has not yet been established as trusted.
     sig:                     {_VERIFY_FILE_SIGNATURE exit(0xe0000242)} 16:08:48.553

this is old os and we cannot resign driver anymore Please check netkvm.cat certificate and if it untrusted, add it manually to trusted store

this?

[YanVugenfirer]

@bbbccvbvv Can you please enable test signing on the system and check if the driver loads?

Run
bcdedit /set testsigning on with admin privileges and reboot

[bbbccvbvv]

bcdedit /set testsigning on

The original machine cannot enable Test Mode. We suspect system corruption, but the sfc /scannow scan result shows no issues.
On a different Win2012R2 machine, after enabling Test Mode, the netkvm driver (versions 21500/24000) installed successfully. However, after disabling Test Mode post-installation, the network adapter remains unavailable.
(1) Does this mean Win2012R2 machines must keep Test Mode enabled permanently going forward? This poses a security risk.
(2) Additionally, does Microsoft have any official patch or method to address the issue of older OS versions failing to recognize drivers signed with newer certificates?

[YanVugenfirer]

@bbbccvbvv MS is no longer providing WHQL signatures for Windows Server 2012R2 and they deprecated cross-signing certificates.
https://learn.microsoft.com/en-us/windows-hardware/drivers/install/deprecation-of-software-publisher-certificates-and-commercial-release-certificates

[bbbccvbvv]

@YanVugenfirer @kostyanf14
I know. Thanks for reply.