"Service failed to start, verify that you have sufficient privileges" is usually a symptom rather than the cause. The installer asks Windows to start the OpenVPN service, the service or its driver refuses to load, and Windows reports it with that generic text.
Two things to sort out on a Windows 7 machine.
Version support. The 2.6 and 2.7 installers target Windows 10 and later. The 2.5.x line is the last one that supports Windows 7 SP1, so if the build you finally got to start installing is 2.6.x or 2.7.x you should expect exactly this class of failure. Also, if you do run a newer installer, its DCO driver needs Windows 10; the tap-windows6 adapter is the one that works on 7.
Missing platform updates. On Windows 7 SP1 the service and drivers commonly fail to start when the system is missing:
- KB2999226, the Universal C Runtime, which newer builds link against;
- KB3033929 and KB4474419, SHA-2 code signing support, without which the signed service binary and the TAP driver are rejected.
Install those, reboot, then run the installer again. That alone clears most of these failures on 7. SP1 itself is a prerequisite for all of them.
A few other things worth doing:
- Right-click the installer and choose Run as administrator with an account that is genuinely a local administrator, rather than accepting a UAC prompt as a standard user.
- If the newer installer got part way in, uninstall it and remove any leftover TAP adapter in Device Manager before installing the older build, otherwise the driver install can fail silently.
- PIA publish OpenVPN config files on their site. Extract them into the OpenVPN
config folder, then connect from the GUI with your PIA username and password. Nothing else is needed on the client side.
If it still refuses, the evidence that actually names the fault is a verbose MSI log (msiexec /i openvpn-x.x.x.msi /l*v C:\ovpn-install.log) and the System event log entries at the moment the service fails. Post the failing lines and it is usually obvious.
One honest caveat: Windows 7 has had no security updates for years, so the machine itself is the weak point no matter which VPN client you get running on it. Worth planning around rather than relying on long term.
