Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

wimfltr.sys expired certificate - causing install failure

Created: 20 Jun 2013 | 7 comments

Hi all,

I am trying to do an unattended/silent upgrade of v6.5 clients to v7.1 (and then patch

During the installation of v7.1, Windows (Server 2003 x86 SP2) is prompting me to install the driver wimfltr.sys. This prompt is only seen if I log in locally, or using the /console session.

I am unsure why this is happening. I have seen: which says that the error can be ignored. In my case, it can't as the installation never completes until a human logs in and clicks the OK button. The group policy is set for:

Devices: Unsigned driver installation behavior = Silenty succeed.

The registry key at HKLM\SOFTWARE\Microsoft\Driver Signing\Policy, is set to value 00.

This only seems to happen on *some* servers, not all of them. Today, two failed this way, and one succeeded. All were running client 6.5.3 on Windows 2003 Enterprise x86 SP2.

On the servers that experienced this issue, I also noticed (in the console session, nowhere else) warnings that processes such as bpbkar32, bpinetd, winlogon and csrss had "NetBackup dlls loaded which need to be replaced". I've seen that appears to explain the cause of this, but it doesn't apply to client 7.1.

I'm not sure if that's related to the WimFltr.sys issue, or not.

Is there a workaround for the wimfltr issue? I can't find a download for Windows 2003 from MS that would install it. The TECH177388 page says that "Symantec is in the process of working with Microsoft to either obtain an updated WimFltr.sys driver file with an updated Digital Signature Certificate, or obtain an alternate valid driver file to replace 'WimFltr.sys'." - but that was last updated in December 2011.

Can anyone suggest how I might be able to get around this? The odd server here and there isn't too much a problem logon to a click a prompt on, but I have ~ 7,000 clients to update.

Many thanks,


Operating Systems:

Comments 7 CommentsJump to latest comment

Yasuhisa Ishikawa's picture

I think this group policy (Devices: Unsigned driver installation behavior) is obsoleted and has no effect to Vista based Windows including Windows Server 2008. i could not find such policy in Windows Server 2008 domain. Check this MS KB article.

although TECH56389 was published for NetBackup 6.5, this issue seems to has nothing secific to 6.5. It may happen with other version of NetBackup.

Authorized Symantec Consultant(ASC) Data Protection in Tokyo, Japan

adamth0's picture

Thanks for your response.

It's on Windows 2003 SP2 that I'm getting the issue.

I'm now wondering if there is another package which would install this driver ahead of the NBU client installation.

Yasuhisa Ishikawa's picture

Oh, sorry! I have miunderstood your configuration. I have mever heard independent package for wimfltr.sys.

BTW, i have stirange experience with wimfltr.sys. Remote client  installation drops this file. I have confirmed this issue with Windows Server 2008 R2 and NetBackup 7.5. I'm not sure why it happens yet.

Authorized Symantec Consultant(ASC) Data Protection in Tokyo, Japan

Dyneshia's picture

According to the screen shot you uploaded, bpbkar is still running and this is why it is not completing the install.  The wimfltr.sys is a separate message/issue

Please open task manager and end task on bpbkar.  Then try the install again.

Dyneshia's picture
adamth0 were you able to end task on bpbkar and complete the install ?
adamth0's picture

The bpbkar32.exe issue is mostly fine, I've been able to script a way around this (ie kill the processes).

The real issue is wimfltr.sys. That's a major hold-up, if it requires manual intervention on each of 3,000 servers that we're tyring to automate deployment to.

Mark_Solutions's picture

Interesting that the same file has been used in V7, 7.1 and 7.5 (even 7.6 beta!)

The only think i can think is that you install this manually (scripted) first to your servers?

I am not an expert in that sort of thing but there is the sys and the inf file inlcuded in the PC_Clnt\x86\ so can be extracted, renamed and installed

Not sure if this helps - was hoping to find a different version of the file in the cab files of all versions but no luck with that one.

Authorised Symantec Consultant

Don't forget to "Mark as Solution" if someones advice has solved your issue - and please bring back the Thumbs Up!!.