[tomasz86]

I've found a very simple way to completely disable Driver Signing during Windows setup without using hacked DLLs or any other 3rd party tools. It still has to be polished and made more automated as at the moment you need to have another working Windows to apply the required settings.

This guide is written for Windows 2000 but you should be able to do the same in XP/2003:

• Open I386\hivesft.inf, scroll it to the bottom and add:
  
  

  [AddReg]
  HKLM,"SOFTWARE\Microsoft\Driver Signing","Policy",0x00000001,00
  

  
  
  
• Prepare your boot media (CD, HDD, USB flash disk, etc.) and start the installation.
  
  
• After the first part of partitioning and file copying has finished don't continue with the GUI part but rather boot to another working Windows installation or move the media to another computer.
  
  
• Go to X:\WINNT\system32\config (X being the letter of the partition / drive where you've just started the installation), open a commandline window and type:
  
  

  reg load hku\custom software
  

  
  The M$ tool REG.EXE is required to do this step. It's available by default in XP/2003 and it's located in SUPPORT.CAB on the Windows 2000 CD (it's also possible to use the XP version in 2K but not the one from 2003).
  
  
• Open REGEDT32.EXE, go to HKU\custom\Microsoft, select "Driver Signing", open Security -> Permissions and deny Full Control for both Administrators and SYSTEM (not sure yet whether both of them are absolutely necessary; maybe only one of them would be enough).
  
  
• Once again go to X:\WINNT\system32\config and type in commandline:
  
  

  reg unload hku\custom
  

  
  
  
• Reboot / move the media back and continue with the Windows installation. You won't see any prompts concerning unsigned drivers any more If you check the setuperr.log you will see something like this:
  
  

  Quote

  Warning:
  
  Setup was unable to configure the policy for verification of drivers during system installation. The error code is 5.
  
  ***
  
  but you can safely ignore it.

At the moment I'm working on setting the permissions automatically so that everything would be done inside Windows setup without the need to boot to another Windows in order to configure them.

This post has been edited by tomasz86: 21 September 2012 - 10:24 PM

[jaclaz]

I am not sure to understand.
Why one cannot use the UNattended setting:
http://technet.micro...y/cc977156.aspx
and later fix the permision issue?
In case you need to do it "before install", the usual approach to reset/set permissions is changing setupreg.hiv, similar to this:
http://www.911cd.net...pic=15138&st=29

jaclaz

[tomasz86]

I need to use a universal method because I'm going to add new drivers to driver.cab in USP5.2 and in order to so it's necessary to modify their INF files. Doing so will break the signatures. Therefore using [Unattended] is out of question here and I'd like to avoid disabling SFC if possible.

Isn't SETUPREG.HIV only for HKLM\SYSTEM entries? I need to change the ones under HKLM\SOFTWARE. I've already tried to use the NT4.0 approach and prepare a pre-compiled "%SystemRoot\system32\config\software" file (NT4.0 doesn't use hive*.inf files) with the permissions defined but unfortunately all registry files are automatically reseted at the end of the text setup just before the hive files are applied.

I know how to set the permissions from commandline using SubInACL (even though it's an MSI file you can just unpack it using 7-Zip and use subinacls.exe):

subinacls.exe /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Driver Signing" /deny=Administrator
subinacls.exe /subkeyreg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Driver Signing" /deny=SYSTEM

Now the problem is how to run these two commands either at the very end of the text setup or in the very beginning of the GUI setup. It has to be done before the GUI setup replaces the modified Driver Signing Policy value with its default one.

This post has been edited by tomasz86: 22 September 2012 - 04:16 AM

[jaclaz]

tomasz86, on 22 September 2012 - 03:43 AM, said:

Isn't SETUPREG.HIV only for HKLM\SYSTEM entries? I need to change the ones under HKLM\SOFTWARE.

Yes, my bad, overlooked that.

Usual semi-random idea
Mixing *somehow* runonce-ex:
http://gosh.msfn.org...g_runonceex.htm
with setup security.inf?
http://www.microsoft...s.mspx?mfr=true

jaclaz

[tomasz86]

I've already tried:

RunOnce
RunOnce\setup
RunOnceEx

but the problem is that all of them are executed too late (at the famous T-13 stage) so they can't be used in this particular case. I don't know too much about security.inf but it's stated that those settings are for NTFS only (FAT's not supported).

I've found one interesting thing and I'm looking at it at the moment. Several services are started during the GUI setup and I'm going to try adding a batch script with the lines mentioned above (#3) as service. I'm talking about the list under HKLM\SYSTEM\Setup\AllowStart which looks like this in Win2k:

AFD
EventLog
PlugPlay
ProtectedStorage
Rpcss
SamSs
Seclogon
WS2IFSL

Edit: http://support.micro....com/kb/q243486 & http://support.microsoft.com/kb/137890

This post has been edited by tomasz86: 22 September 2012 - 09:58 AM

[cdob]

tomasz86, on 22 September 2012 - 03:43 AM, said:

Now the problem is how to run these two commands either at the very end of the text setup or in the very beginning of the GUI setup.

The classic approach uses a third party fake setup.exe
http://www.msfn.org/...rivers-from-cd/
WatchDriverSigningPolicy.exe has to run at PNP part always.

Post #837 http://www.msfn.org/...i/page__st__825
describe a example to fix driver signing state.
Run dsigning.exe first and continue.


Contrary XP bth.inf list a registry security example [BthPort.NT.Setup.AddReg.Security]
Can security settings added to hivesft.inf ?

INF AddReg Directive

Quote

An add-registry-section can have any number of entries, each on a separate line. An INF can also contain one or more optional add-registry-section.security sections, each specifying a security descriptor that is applied to all registry values described within a named add-registry-section.

[tomasz86]

I want to do this without using any 3rd party tools and I've almost managed to do it by running subinacls.exe as a service... but this AddReg security thing looks very promising. I knew that secedit.exe can be used to modify permissions but didn't know that you can do it directly from INF. I wonder whether it's supported in Win2k too. I'll give it a try and report the results.

[tomasz86]

This is getting way more difficult than I initially though it would be...

• cdob, on 22 September 2012 - 11:18 AM, said:

  Contrary XP bth.inf list a registry security example [BthPort.NT.Setup.AddReg.Security]
  Can security settings added to hivesft.inf ?
  
  I've tried adding this to TXTSETUP.SIF:
  
  

  [HiveInfs.Fresh]
  AddReg = hivesft.inf,AddReg.DrvSign
  

  
  and this to HIVESFT.INF:
  
  

  [AddReg.DrvSign]
  HKLM,"SOFTWARE\Microsoft\Driver Signing",,0x00000010
  HKLM,"SOFTWARE\Microsoft\Driver Signing","Policy",0x00000001,00
  
  [AddReg.DrvSign.Security]
  "D:P(A;CI;GA;;;BA)(A;CI;GA;;;SY)"
  

  
  Frankly speaking, I'm completely confused about the security settings here. The above example is taken from http://msdn.microsof...y/aa377450.aspx and is supposed to do this:
  
  

  Quote

  the meaning of the string is that administrators have full control, system has full control, and access is inheritable to all subkeys
  
  I just took it as an example. By default there are no permissions defined for the registry key (empty boxes next to Administrators and SYSTEM). Unfortunately there is no effect of such settings. I don't know if it's me doing it wrongly or maybe these settings can't be applied from TXTSETUP.SIF. I'd be very thankful for more information about this from someone more knowledgeable than myself.
  
  
• I've been trying to run "subinacl.exe" as a service but it doesn't work either. I've tried to run it directly by using SHIFT+F10 to open a CMD window at the beginning of the GUI setup but typing "subinacl.exe" doesn't produce any output. Maybe it's too early to support this kind of tool or there are some unfixed dependencies (the system used for testing is a clean Win2k SP4 with no other updates integrated).
  
  This is how I added the service using HIVESYS.INF:
  
  

  [AddReg]
  
  HKLM,"SYSTEM\CurrentControlSet\Services\subinacl","Type",0x00010001,10,00,00,00
  HKLM,"SYSTEM\CurrentControlSet\Services\subinacl","Start",0x00010001,02,00,00,00
  HKLM,"SYSTEM\CurrentControlSet\Services\subinacl","ErrorControl",0x00010001,01,00,00,00
  HKLM,"SYSTEM\CurrentControlSet\Services\subinacl","ImagePath",0x00020000,"%SystemRoot%\system32\srvany.exe"
  HKLM,"SYSTEM\CurrentControlSet\Services\subinacl","DisplayName",0x00000000,"subinacl"
  HKLM,"SYSTEM\CurrentControlSet\Services\subinacl","ObjectName",0x00000000,"LocalSystem"
  HKLM,"SYSTEM\CurrentControlSet\Services\subinacl\Parameters","Application",0x000000000,"subinacl.exe /keyreg ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Driver Signing"" /deny=Administrators"
  
  HKLM,"SYSTEM\Setup\AllowStart\subinacl",,0x00000010
  

  
  This does work in a running system.

At the moment I still need to do more tests related to the service because I don't know whether it runs but fails or rather doesn't run at all. This is a "standard" list of services which are started at the beginning of the GUI setup:

Spoiler

I've also found out that (most of?) system files are not registered yet at this stage so it's necessary to always use full paths, ex. "%systemroot%\regedit" instead of just "regedit".

This post has been edited by tomasz86: 23 September 2012 - 05:23 AM

[dencorso]

Try to set Start = 1 (system) or even 0 (boot), instead of 2 (automatic). It's a longshot, but may work.

[tomasz86]

The service does start. I've just checked it once again. The problem is that "subinacl.exe" doesn't want to work at this stage of the Windows setup I'm now going to try settings the permissions though an INF file launched from commandline run as a service.

I've finally managed to find this:



http://msdn.microsof...e/gg487483.aspx

This is the REG file:

[version]
Signature="$Windows NT$"

[DefaultInstall]
AddReg=AddReg.DrvSign

[AddReg.DrvSign]
HKLM,"SOFTWARE\Microsoft\Driver Signing",,0x00000010
HKLM,"SOFTWARE\Microsoft\Driver Signing","Policy",0x00000001,00

[AddReg.DrvSign.Security]
"D:P(D;;GA;;;SY)"

Would running

rundll32 setupapi,InstallHinfSection DefaultInstall 132 drvsign.inf

be enough? I've just tried to run it but it hasn't affected the permissions...

This post has been edited by tomasz86: 23 September 2012 - 06:18 AM

[jaclaz]

Unless I am mistaken, subinacl.exe is anyway a "third-party tool in the sense that it is in the Resource Kit.

Just for the record:
http://sourceforge.n...ource=directory
http://sourceforge.n.../aclutil/files/

http://www.windowsne...ommandLine.html
http://helgeklein.com/setacl/examples/
http://web.archive.o...~micro/regperm/
http://www.softpedia...egSecEdit.shtml

Maybe some of these can run "earlier"

Also, maybe useful, maybe not :
http://www.msfn.org/...rack-passwords/


jaclaz

This post has been edited by jaclaz: 23 September 2012 - 07:54 AM

[tomasz86]

By "3rd party" tools I meant the ones not coming from M$ but of course I'll try them if there's no other way to get it done.

"Regini.exe" is kind of interesting. I've already seen it mentioned before but (like listed here) I thought that it was only able to add new permissions but not "deny" any access. Now I'm seeing this:

Quote

When you use Regini in this way, it actually replaces all permissions with those specified in the script, so to change "Everyone-Read" to "Everyone-Full Control," the new permission (number 7) must be applied, along with the other existing permissions

so it seems that setting "Administrators" to read-only may actually work. I need to try using it during the GUI setup. Regini.exe itself is kind of primitive when compared to subinacl.exe so there's probably higher probability that it will work.

Now I'm really curious why the security settings added through INF don't work (see #10). For testing purposes I've even tried applying the already mentioned BTH.INF from XP (after removing all other unrelated entries) and still the permissions didn't change after doing it I'm talking about a running system, not only the GUI setup.

This post has been edited by tomasz86: 23 September 2012 - 10:33 AM

[cdob]

tomasz86, on 22 September 2012 - 02:21 PM, said:

I want to do this without using any 3rd party tools and I've almost managed to do it by running subinacls.exe

Well, subincals is not not a default application. Created by OS manufactuer
Does this refer as 1st, 2nd or 3rd party tool?

Quote

this AddReg security thing looks very promising.

Try at XP first:
txtsetup.sif

[SourceDisksFiles]
dSigning.inf = 1,,,,,,_x,,3,3

[HiveInfs.Fresh]
AddReg = dSigning.inf,DriverSigning.AddReg

[HiveInfs.Upgrade]
AddReg = dSigning.inf,DriverSigning.AddReg

dosnet.inf

[Files]
D1,dSigning.inf

dSigning.inf

[Version]
Signature="$CHICAGO$"

[DefaultInstall]
DelReg=DriverSigning.DelReg
AddReg=DriverSigning.AddReg

[DriverSigning.DelReg]
HKLM,"SOFTWARE\Microsoft\Driver Signing"
HKLM,"SOFTWARE\Microsoft\Driver Signing debug"

[DriverSigning.AddReg]
HKLM,"SOFTWARE\Microsoft\Driver Signing","Policy",0x1,00
HKLM,"SOFTWARE\Microsoft\Driver Signing debug","Policy",0x1,00

[DriverSigning.AddReg.Security]
"D:P(A;;GR;;;SY)(A;;GR;;;WD)"

Example inf file Un-grpconv.inf
http://technet.micro...lletin/ms04-037

Driver Signing policy is set to 00 at end of textmode.
And is available at full installed XP stil.

No idea about 2000.


Added:
Driver Signing policy is set to 00. However driver has to be signed still.

Added2:
Driver Signing policy is at strange state:
A edited usbstor.inf added
GUI mode PNP does install USB storage device without a message.
Full installed XP ask for drivers, if a new USB device attached.
Seems to be nice work around as for GUI mode PNP.

Correction:
I apologize: winnt.sif DriverSigningPolicy=Ignore was set in adddition.
That's nonsese of course.

dSigning.inf is added at end of textmode, security settings are set.
However system is owner still.
System PNP part does reset the Driver Signing setting.
Driver Signing is required at PNP part.

This post has been edited by cdob: 23 September 2012 - 10:56 PM

[tomasz86]

@cdob

It seems that setting DriverSigningPolicy=Ignore in WINNT.SIF changes the registry value to 00. That's why the signing policy had been first disabled during the GUI setup but available later after the system was started for the first time. I've found out that there are two checks for the policy during the GUI setup - one at the very beginning and another one near the end. This would explain how the policy is turned off (due to the WINNT.SIF settings) and then turned on after the setup has finished.

I've done some testing with XP but I couldn't manage to make the AddReg Security settings through TXTSETUP.SIF work. On the other hand, REGINI.EXE does work and it's possible to adjust the permission settings when it's run as a service. I set "Administrators" to read only and the system was unable to change it It remained switched off from the beginning till the end. Now I only need to prepare a script which would add all the necessary settings automatically - add/change lines in TXTSETUP.SIF, HIVESYS.INF and DOSNET.INF. Actually, the only required tool which is not available in Windows by default is SRVANY.EXE because REGINI.EXE is actually present in all Windows 2000/XP/2003. The only problem is that it's not copied to the Windows folder by default (it's just available on the CD) so it's necessary to change the line in TXTSETUP.SIF so that it will be copied to %SystemRoot%\system32.

In order to use REGINI.EXE it's necessary to create a text file (regini.txt here) with the following info:

"\registry\machine\software\microsoft\driver signing" [2]

and then run:

regini regini.txt

Later after I've finished testing and preparing the scripts I'll post a detailed guide about what's got to be done in details.

[jaclaz]

Humble suggestion (replacements for SRVANY):
http://nssm.cc/
http://www.softpedia...BC-SrvAny.shtml
More:
http://www.msfn.org/...m-as-a-service/
(cannot say if it any will do in your setup)

I still see a Reskit only tool as "third party" as "anything else", but additionally NOT redistributable .

jaclaz

[tomasz86]

Well, if possible I'd still prefer to use M$ tools in this case. Anyone can download Windows Server 2003 Resource Kit Tools and extract SRVANY.EXE from there.

By the way, REGINI.EXE itself is quite interesting. This works:

• regini.txt
  
  

  \registry\machine\software\microsoft\driver signing[2]
  Policy=REG_BINARY 0x00000001 00
  

  
  No quotes are required, some spaces can be omitted and it still works properly. The above configuration sets the Policy value to 00 and sets permissions for "Administrators" to read only.
  
  

• regini regini.txt
  

At the moment I'm testing something like this as service:

cmd.exe /c "CD/D %SystemRoot%\system32& (ECHO \registry\machine\software\microsoft\driver signing[2]& ECHO Policy=REG_BINARY 0x00000001 00)>dsigning.txt& REGINI.EXE dsigning.txt& NET.EXE STOP dsigning& REG.EXE DELETE HKLM\SYSTEM\CurrentControlSet\Services\dsigning /F& DEL dsigning.txt"

so that the TXT file will be created on the fly and later the service will be automatically stopped and removed.

HIVESYS.INF settings:

[AddReg]
HKLM,"SYSTEM\CurrentControlSet\Services\dsigning","Type",0x00010001,10,00,00,00
HKLM,"SYSTEM\CurrentControlSet\Services\dsigning","Start",0x00010001,02,00,00,00
HKLM,"SYSTEM\CurrentControlSet\Services\dsigning","ErrorControl",0x00010001,01,00,00,00
HKLM,"SYSTEM\CurrentControlSet\Services\dsigning","ImagePath",0x00020000,"%SystemRoot%\system32\srvany.exe"
HKLM,"SYSTEM\CurrentControlSet\Services\dsigning","DisplayName",0x00000000,"dsigning"
HKLM,"SYSTEM\CurrentControlSet\Services\dsigning","ObjectName",0x00000000,"LocalSystem"
HKLM,"SYSTEM\CurrentControlSet\Services\dsigning\Parameters","Application",0x000000000,"cmd.exe /c "CD/D %SystemRoot%\system32& (ECHO \registry\machine\software\microsoft\driver signing[2]& ECHO Policy=REG_BINARY 0x00000001 00)>dsigning.txt& REGINI.EXE dsigning.txt& NET.EXE STOP dsigning& REG.EXE DELETE HKLM\SYSTEM\CurrentControlSet\Services\dsigning /F& DEL dsigning.txt""
HKLM,"SYSTEM\Setup\AllowStart\dsigning",,0x00000010

[jaclaz]

tomasz86, on 25 September 2012 - 12:49 PM, said:

Well, if possible I'd still prefer to use M$ tools in this case. Anyone can download Windows Server 2003 Resource Kit Tools and extract SRVANY.EXE from there.

Until the good MS guys decide to remove it.....
If possible it is always better (iMHO) to use freely redistributable tools.

jaclaz

[tomasz86]

jaclaz, on 25 September 2012 - 12:52 PM, said:

Until the good MS guys decide to remove it.....
If possible it is always better (iMHO) to use freely redistributable tools.

In this particular case I'm going to use this method in the future USP5.2 and even though it's an unofficial SP I still think that sticking to M$ tools is preferable. Of course everyone can use different applications to run the script as service if you wish I'm not going to provide any files in this topic as it's just informative. If someone's interested then he can do everything himself basing on the instructions.

After testing I can confirm that this script can be launched as a service:

cmd.exe /c ""(ECHO \registry\machine\software\microsoft\driver signing[2]& ECHO Policy=REG_BINARY 0x00000001 00)>%SystemRoot%\system32\dsigning.txt& REGINI.EXE %SystemRoot%\system32\dsigning.txt& DEL %SystemRoot%\system32\dsigning.txt""

It's not possible to stop & remove the service from the same commandline when it's launched as the same service so I'm going to stop & remove it using RunOnce or maybe svcpack.inf.

[cdob]

tomasz86, on 25 September 2012 - 10:26 AM, said:

I've done some testing with XP but I couldn't manage to make the AddReg Security settings through TXTSETUP.SIF work.

Yes, I've no success too after testing. Setup seems not to set AddReg security at textmode.

Quote

]REGINI.EXE does work and it's possible to adjust the permission settings

That's nice.

At XP: Running CMD.EXE as Local System http://blogs.msdn.co.../27/271063.aspx

Running cmd as system and driver signing set:

[SourceDisksFiles]
regini.exe   = 1,,,,,,,2,0,0

[DriverSigning.AddReg]
HKLM,"SYSTEM\Setup\AllowStart\SystemCmd",,0x10
HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd","Type",0x10001,0x110
HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd","Start",0x10001,0x2
HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd","ErrorControl",0x10001,0x1
;HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd","ImagePath",0x20000,"cmd.exe /k start cmd.exe"
;debug: &pause
HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd","ImagePath",0x20000,"cmd.exe /c start cmd.exe /c ""(ECHO \registry\machine\software\microsoft\driver signing[2]& ECHO Policy=REG_BINARY 0x00000001 00)>\dsigning.txt& REGINI.EXE \dsigning.txt& pause& DEL \dsigning.txt"""
HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd","ObjectName",0x0,"LocalSystem"

HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd\Enum","0",0x0,"Root\LEGACY_SYSTEMCMD\0000"
HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd\Enum","Count",0x10001,0x1
HKLM,"SYSTEM\CurrentControlSet\Services\SystemCmd\Enum","NextInstance",0x10001,0x1

HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCMD","NextInstance",0x10001,0x1
HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCMD\0000","Service",0x0,"SystemCmd"
HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCMD\0000","Legacy",0x10001,0x1
HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCMD\0000","ConfigFlags",0x10001,0x0
HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCMD\0000","Class",0x0,"LegacyDriver"
HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCMD\0000","ClassGUID",0x0,"{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCMD\0000","DeviceDesc",0x0,"SystemCmd"
HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCMD\0000\Control","*NewlyCreated*",0x10001,0x1

A cleaning "sc.exe delete SystemCmd" would be nice in addition.

Driver Signing is set to 0. And disabled at GUI mode setup.
No question at PNP unsigned *.inf files.

However driver Signing is required at full installed XP, despide Driver Signing state 0x0 still.

[tomasz86]

This is very interesting. It shall be possible to avoid using SRVANY.EXE at all

I'd like not to rely on SC.EXE because it's not available in 2K. That's why I'm trying to remove the service from the registry using REG.EXE which is available by default in XP/2003 and also in 2K's SUPPORT.CAB.

This may be necessary to suppress driver signing in the running system:

hivedef.inf

[AddReg]
HKCU,"SOFTWARE\Policies\Microsoft\Windows NT\Driver Signing","BehaviorOnFailedVerify",0x00010001,0

Edit: Actually NET STOP works too:

cmd.exe /c ""(ECHO \registry\machine\software\microsoft\driver signing[2]& ECHO Policy=REG_BINARY 0x00000001 00)>\dsigning.txt& REGINI.EXE \dsigning.txt& DEL \dsigning.txt& NET STOP dsigning""

so it is possible to stop the service but not possible to remove it at once.

Edit 2: But it seems that there's no need to use NET STOP in case of a cmd.exe service because it's always terminated automatically.

This post has been edited by tomasz86: 26 September 2012 - 05:17 AM