Can't connect - network driver can't be installed

[AndWei]

Hi. I have GlobalProtect 6.0.5-30 successfully installed on Win10 (no installation errors reported). However, the network driver - PanGpd - wasn't installed correctly, and when I try to connect in GP, nothing happens. This is in C:\Windows\INF\setupapi.dev.log, when the driver is installed. At the end, it removes the driver and fails with 0x8007007e.

Any suggestions how to fix this?

>>>  [Install network driver - PanGpd]
>>>  Section start 2023/11/13 09:06:56.392
      cmd: "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit
     dvi: Installing new driver
     dvi: {Create Device} 09:06:56.392
     dvi:      {Create Device - PanGpd}
     dvi:           Class GUID  - {4d36e972-e325-11ce-bfc1-08002be10318}
     dvi:           Description - <none>
     dvi:           Flags       - 0x00000001
     dvi:           Created device 'ROOT\PANGPD\0000'
     dvi:      {Create Device - exit(0x00000000)}
     dvi: {Create Device - exit(0x00000000)} 09:06:56.392
     dvi: {Build Driver List} 09:06:56.392
     dvi:      Searching for hardware ID(s):
     dvi:           pangpd
     dvi:      Created Driver Node:
     dvi:           HardwareID   - PanGpd
     dvi:           InfName      - C:\WINDOWS\System32\DriverStore\FileRepository\pangpd.inf_amd64_0fac4a66465a8bd9\pangpd.inf
     dvi:           DevDesc      - PANGP Virtual Ethernet Adapter Secure
     dvi:           Section      - PanGpd.ndi
     dvi:           Rank         - 0x00ff0000
     dvi:           Signer Score - WHQL
     dvi:           DrvDate      - 10/26/2022
     dvi:           Version      - 16.50.57.481
     dvi: {Build Driver List - exit(0x00000000)} 09:06:57.258
     dvi: {Select Best Driver}
     dvi:      Class GUID of device changed to: {4d36e972-e325-11ce-bfc1-08002be10318}.
     dvi:      Selected Driver:
     dvi:           Description - PANGP Virtual Ethernet Adapter Secure
     dvi:           InfFile     - c:\windows\system32\driverstore\filerepository\pangpd.inf_amd64_0fac4a66465a8bd9\pangpd.inf
     dvi:           Section     - PanGpd.ndi
     dvi: {Select Best Driver - exit(0x00000000)}
     dvi: {DIF_REGISTERDEVICE} 09:06:57.258
     dvi:      Default installer: Enter 09:06:57.258
     dvi:           {Register Device - ROOT\PANGPD\0000}
     dvi:                Registered: ROOT\PANGPD\0000
     dvi:           {Register Device - exit(0x00000000)}
     dvi:      Default installer: Exit
     dvi: {DIF_REGISTERDEVICE - exit(0x00000000)} 09:06:57.271
     dvi: {DIF_ALLOW_INSTALL} 09:06:57.272
     dvi:      Default installer: Enter 09:06:57.272
     dvi:      Default installer: Exit
     dvi: {DIF_ALLOW_INSTALL - exit(0xe000020e)} 09:06:57.272
     dvi: {DIF_INSTALLDEVICEFILES} 09:06:57.272
     dvi:      Default installer: Enter 09:06:57.272
     dvi:           {_SCAN_FILE_QUEUE} 09:06:57.272
     sig:                {_VERIFY_FILE_SIGNATURE} 09:06:57.272
     sig:                     Key      = pangpd.sys
     sig:                     FilePath = C:\WINDOWS\system32\DRIVERS\pangpd.sys
     sig:                     Catalog  = c:\windows\system32\driverstore\filerepository\pangpd.inf_amd64_0fac4a66465a8bd9\pangpd64.cat
!    sig:                     Verifying file against catalog 'pangpd64.cat' failed.
!    sig:                     Error 2: The system cannot find the file specified.
     sig:                {_VERIFY_FILE_SIGNATURE exit(0x00000002)} 09:06:57.282
     dvi:           {_SCAN_FILE_QUEUE - exit(0x00000000)} 09:06:57.283
     flq:           {FILE_QUEUE_COMMIT} 09:06:57.283
     flq:                Copying 'C:\WINDOWS\System32\DriverStore\FileRepository\pangpd.inf_amd64_0fac4a66465a8bd9\pangpd.sys' to 'C:\WINDOWS\system32\DRIVERS\pangpd.sys'.
     flq:           {FILE_QUEUE_COMMIT - exit(0x00000000)} 09:06:57.353
     dvi:      Default installer: Exit
     dvi: {DIF_INSTALLDEVICEFILES - exit(0x00000000)} 09:06:57.355
     dvi: {DIF_REGISTER_COINSTALLERS} 09:06:57.355
     dvi:      Reset Device: Resetting device configuration. 09:06:57.355
     dvi:      Reset Device: Resetting device configuration completed. 09:06:57.355
     dvi:      Default installer: Enter 09:06:57.357
     inf:           {Install from INF Section - PanGpd.ndi.CoInstallers} 09:06:57.359
     inf:                Flags         - 0x001001ee
     inf:           {Install from INF Section - exit(0x00000000)} 09:06:57.360
     dvi:      Default installer: Exit
     dvi: {DIF_REGISTER_COINSTALLERS - exit(0x00000000)} 09:06:57.360
     dvi: {DIF_INSTALLINTERFACES} 09:06:57.360
     dvi:      Default installer: Enter 09:06:57.360
     dvi:      Default installer: Exit
     dvi: {DIF_INSTALLINTERFACES - exit(0x00000000)} 09:06:57.360
     dvi: {DIF_INSTALLDEVICE} 09:06:57.360
     dvi:      Default installer: Enter 09:06:57.360
     dvi:           {Install DEVICE}
     inf:                {Install from INF Section - PanGpd.ndi} 09:06:57.360
     inf:                     Flags         - 0x00000001
     inf:                {Install from INF Section - exit(0x00000000)} 09:06:57.360
     inf:                {Install from INF Section - PanGpd.ndi} 09:06:57.360
     inf:                     Flags         - 0x001005ee
     inf:                {Install from INF Section - exit(0x00000000)} 09:06:57.360
     dvi:                {Writing Device Properties}
     dvi:                     Strong Name=oem338.inf:7b9af9ed2f08d9d3:PanGpd.ndi:16.50.57.481:pangpd
     dvi:                {Writing Device Properties - Complete}
     inf:                AddService=PanGpd,2,PanGpd.Service  (pangpd.inf line 46)
     dvi:                Add Service: Created service 'PanGpd'.
     inf:                {Install from INF Section - PanGpd.Service} 09:06:57.376
     inf:                     Flags         - 0x00100004
     inf:                {Install from INF Section - exit(0x00000000)} 09:06:57.376
     dvi:           {Install DEVICE exit (0x00000000)}
     sto:           {Configure Driver Package: c:\windows\system32\driverstore\filerepository\pangpd.inf_amd64_0fac4a66465a8bd9\pangpd.inf}
     sto:                Source Filter  = PanGpd.ndi
     sto:                Target Filter  = ROOT\PANGPD\0000
     inf:                Class GUID     = {4d36e972-e325-11ce-bfc1-08002be10318}
     inf:                Class Options  = Configurable
     inf:                {Configure Driver: PANGP Virtual Ethernet Adapter Secure}
     inf:                     Section Name = PanGpd.ndi
     inf:                     {Configure Device: ROOT\PANGPD\0000}
     inf:                     {Configure Device: exit(0x00000000)}
     inf:                {Configure Driver: exit(0x00000000)}
     sto:           {Configure Driver Package: exit(0x00000000)}
     dvi:           Install Device: Configuring device class. 09:06:57.392
     dvi:           Install Device: Configuring device class completed. 09:06:57.392
     dvi:           Device Status: 0x01802001
!    dvi:           Device restart was skipped (DONOTCALLCONFIGMG).
     dvi:      Default installer: Exit
     dvi: {DIF_INSTALLDEVICE - exit(0x00000000)} 09:06:57.408
     dvi: {DIF_REMOVE} 09:06:57.478
     dvi:      Default installer: Enter 09:06:57.478
     dvi:           {Remove DEVICE}
     dvi:                {Delete Device - ROOT\PANGPD\0000}
     dvi:                     Query-and-Remove succeeded
     dvi:                {Delete Device - exit(0x00000000)}
     dvi:           {Remove DEVICE exit (0x00000000)}
     dvi:      Default installer: Exit
     dvi: {DIF_REMOVE - exit(0x00000000)} 09:06:57.501
<<<  Section end 2023/11/13 09:06:57.502
<<<  [Exit status: FAILURE(0x8007007e)]

[JayGolf]

Hi @AndWei ,

I would recommend uninstalling GP and reinstalling GP. 

[AndWei]

Hi - I've already done that several times. Behaviour doesn't change, it just fails the same way every time.

[MatthewDeSantos]

I'm having this exact issue upgrading from 5.2.13 to 6.0.7 so I'm interested in the solution as well. 

[AndWei · Accepted solution]

I've found the answer. The PC had a remnant of Cisco AnyConnect left behind after the product was uninstalled. I was able to rename this registry entry: HKEY_CLASSES_ROOT\CLSID\{9e871141-0120-4c3e-aba2-8f99335b69c1} so that it’s not found, e.g. 9e871141-0120-4c3e-aba2-8f99335b69c1XXX. This is “Cisco AnyConnect Network Access Manager Notify Object”, and it’s interfering with the Global Protect driver installation.

How I found this:

Run ProcessMonitor and filter on PanGPS.exe before you try to connect in Global Protect (you may have to restart the PanGPS service to get it to try to install the driver).

Check C:\Windows\INF\setupapi.dev.log and look for this:

dvi: {DIF_REMOVE} 10:05:30.212
dvi: Default installer: Enter 10:05:30.212
dvi: {Remove DEVICE}
dvi: {Delete Device - ROOT\PANGPD\0000}
dvi: Query-and-Remove succeeded
dvi: {Delete Device - exit(0x00000000)}
dvi: {Remove DEVICE exit (0x00000000)}
dvi: Default installer: Exit
dvi: {DIF_REMOVE - exit(0x00000000)} 10:05:30.231

and note the timestamp: 10:05:30.212. In ProcessMonitor at that timestamp, you should find an entry such as:

CreateFile C:\Windows\INF\setupapi.dev.log

This is where PanGPS is writing the DIF_REMOVE entries to setupapi.dev.log. Immediately preceding that in ProcessMonitor, I saw where PanGPS was accessing the registry with

RegOpenKey HKCR\CLSID\{9E871141-0120-4C3E-ABA2-8F99335B69C1}

As this was the last entry before the DIF_REMOVE was issued, I suspected that this might what was causing PanGPS to remove the driver. I renamed the registry key as described above so that it wouldn't be found, and viola, everything started working.