eBPF for windows can not be installed on Windows server 2019 with Hyper-V enabled

[novitoll]

I'd like to know if there is a way to install eBPF for windows driver on Windows Server 2019 (from AWS) with Hyper-V enabled.

Instructions in documentation are described for the Windows 10/11 Pro, Enterprise versions but the servers should also be supported.
Please advise.

 Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V


FeatureName      : Microsoft-Hyper-V
DisplayName      : Hyper-V
Description      : Hyper-V
RestartRequired  : Possible
State            : Enabled
CustomProperties :
                   ServerComponent\Description : Hyper-V provides the services that you can use to create and manage
                   virtual machines and their resources. Each virtual machine is a virtualized computer system that
                   operates in an isolated execution environment. This allows you to run multiple operating systems
                   simultaneously.
                   ServerComponent\DisplayName : Hyper-V
                   ServerComponent\EventQuery : Virtualization.Events.xml
                   ServerComponent\Id : 20
                   ServerComponent\Type : Role
                   ServerComponent\UniqueName : Hyper-V
                   ServerComponent\Version\Major : 1
                   ServerComponent\Version\Minor : 0
                   ServerComponent\BestPractices\Model\Id : Microsoft/Windows/Hyper-V
                   ServerComponent\Deploys\Update\Name : Microsoft-Hyper-V-Offline
                   ServerComponent\Deploys\Update\Name : Microsoft-Hyper-V-Online
                   ServerComponent\Configuration\RootClassMofDefinition :            class ServerComponent_HyperV
                        {               String VirtualSwitchNetworkAdapters[];               String
                   DefaultVirtualMachinePath;               String DefaultVirtualHardDiskPath;               BOOLEAN
                   EnableVirtualMachineMigration;               String VirtualMachineMigrationAuthenticationType;
                        };
                   ServerComponent\SystemServices\SystemService\DefaultMonitoring : true
                   ServerComponent\SystemServices\SystemService\Name : vmms

[shankarseal]

@shpalani - can you please try to reproduce this issue?

[shpalani]

I'd like to know if there is a way to install eBPF for windows driver on Windows Server 2019 (from AWS) with Hyper-V enabled.

@novitoll : Yes, Windows Server 2019 is supported. We have automation running test cases too!
Can you please collect and share the logs using the option:
msiexec.exe /l*vx .\installer-log.txt /i eBPF-for-windows.msi

Instruction in

• Method-1: https://github.com/microsoft/ebpf-for-windows/blob/main/docs/InstallEbpf.md#:~:text=Troubleshooting%20logs%20from,nstaller%2Dlog.txt

Please ensure the test signing is on using bcdedit.exe -set TESTSIGNING ON

• https://github.com/microsoft/ebpf-for-windows/blob/main/docs/GettingStarted.md#installing-ebpf-for-windows)

Please provide the WDK (Windows Driver Kit) and Windows SDK version installed. They are under 'Add or Remove Programs'.

[novitoll]

@shpalani , thanks, I've tried what you suggested - it didn't work.

Please provide the WDK (Windows Driver Kit) and Windows SDK version installed. They are under 'Add or Remove Programs'.

This is a Windows Server 2019, which means there is no GUI - I can only grab the info from powershell or cmd consoles.

PS C:\Users\Administrator\Desktop\ebpf-for-windows\scripts> .\Get-LatestNugetPackageVersion.ps1
Package name cannot be empty
At C:\Users\Administrator\Desktop\ebpf-for-windows\scripts\Get-LatestNugetPackageVersion.ps1:26 char:9
+         throw "Package name cannot be empty"
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (Package name cannot be empty:String) [], RuntimeException
    + FullyQualifiedErrorId : Package name cannot be empty

PS C:\Users\Administrator> bcdedit.exe -set TESTSIGNING ON
The operation completed successfully.

PS C:\Users\Administrator\Desktop\ebpf-for-windows\scripts> reg add HKLM\Software\Policies\Microsoft\Windows\Installer /v DisableMSI /t REG_DWORD /d 0 /f
The operation completed successfully.

PS C:\Users\Administrator> msiexec.exe /l*vx .\installer-log.txt /i "https://github.com/microsoft/ebpf-for-windows/releases/download/Release-v0.19.2/ebpf-for-windows.0.19.2.msi"

Please see the attached installer-log.txt.
If ebpf-for-windows needs the WDK to be installed, then please provide with the instructions how to do it in Windows Server 2019 powershell console.

Please also note that I am coming from the Linux experience and have a little understanding what's happening and what's required for the ebpf-for-windows driver.

installer-log.txt

[novitoll]

@shankarseal , @shpalani following up

[shpalani]

Thanks for providing the information. I will look into the log, and share the findings.
The latest version is ebpf-for-windows v0.20.0. Did you try that?
Did you reboot the system after "bcdedit.exe -set TESTSIGNING ON", which is required to honor the setting?

[novitoll]

Yes, I've done it, you can check the installer-log.txt I've attached. You can also try to spawn the EC2 on AWS MS Windows Server 2019 and try it. Otherwise Please let me know if there are other troubleshootings

[shpalani]

"... the sofware is not digitally signed."

MSI (c) (C4:80) [05:40:21:804]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'https://github.com/microsoft/ebpf-for-windows/releases/download/Release-v0.19.2/ebpf-for-windows.0.19.2.msi' against software restriction policy
MSI (c) (C4:80) [05:40:21:804]: Note: 1: 2262 2: DigitalSignature 3: -2147287038
MSI (c) (C4:80) [05:40:21:804]: SOFTWARE RESTRICTION POLICY: https://github.com/microsoft/ebpf-for-windows/releases/download/Release-v0.19.2/ebpf-for-windows.0.19.2.msi is not digitally signed
MSI (c) (C4:80) [05:40:21:883]: SOFTWARE RESTRICTION POLICY: https://github.com/microsoft/ebpf-for-windows/releases/download/Release-v0.19.2/ebpf-for-windows.0.19.2.msi is a URL that maps to URL security zone 3 (URLZONE_INTERNET)
MSI (c) (C4:80) [05:40:21:883]: SOFTWARE RESTRICTION POLICY: https://github.com/microsoft/ebpf-for-windows/releases/download/Release-v0.19.2/ebpf-for-windows.0.19.2.msi is permitted to run at the 'unrestricted' authorization level.

Solution:
Please do "reboot' of the system, after ""bcdedit.exe -set TESTSIGNING ON" to take effect.

[novitoll]

I've rebooted it via the PowerShell command "Restart-Computer" and got the same results.

[novitoll]

C:\Users\Administrator>bcdedit.exe -set TESTSIGNING ON
The operation completed successfully.

C:\Users\Administrator>reboot
'reboot' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\Administrator>shutdown /r

Rebooted...

PS C:\Users\Administrator> msiexec.exe /l*vx .\installer-log-3.txt /i "https://github.com/microsoft/ebpf-for-windows/releases/download/Release-v0.20.0/ebpf-for-windows.x64.0.20.0.msi"

It worked! Let me check and verify and confirm. Thanks!

[novitoll]

Just a quick question - how can I verify on the brand new Windows Server 2019 without clang or llvm tools?
I am checking the docs in https://github.com/microsoft/ebpf-for-windows/blob/main/docs/GettingStarted.md but they seem, require the local development environment.

Do you have the execvesnoop like test application so I can compile the .exe at my PC and copy it to the server and execute there?

[shpalani]

Do you have the execvesnoop like test application so I can compile the .exe at my PC and copy it to the server and execute there?

No. Please follow the GettingStarted.md to set up the Windows development environment. Compile the program using clang/llvm. Load the .sys program file on the Winders Server 2019 VM, and test it.

[shpalani]

how can I verify on the brand new Windows Server 2019 without clang or llvm tools?

What do you want to verify?
If you want to check whether 'ebpf-for-windows' is installed?

• Use "Add or Remove Programs" --> Apps -- Installed apps

[shpalani]

@novitoll Can this issue be closed?