Page 1 of 1

Error in creating TAP interface

Posted: Wed Jan 27, 2021 4:07 pm
by stvitaly
I am trying to install openvpn manually on machines, as a part of installation since of openVPN 2.5 I need to install TAP drivers first and then use tapctl to create the device itself.
It works totally fine on most of the devices, but there is an error I got from number of machines (not sure what triggered it on those ones specifically).

Driver installation is looking OK:
driver install
pnputil -i -a OemVista.inf
Microsoft PnP Utility

Processing inf : OemVista.inf
Successfully installed the driver.
Driver package added successfully.
Published name : oem202.inf

Total attempted: 1
Number successfully imported: 1

But then on a small percentage of machines I get an error:

device creation
tapctl.exe create
tap_create_adapter: DiInstallDevice failed
Error 0xe0000248
Creating TUN/TAP adapter failed (error 0xe0000248).

Tried to google the error and got that it means:
Any ideas what can be a reason?

Re: Error in creating TAP interface

Posted: Wed Jan 27, 2021 4:37 pm
by TinCanTech
Probably your version of Windows ..

Re: Error in creating TAP interface

Posted: Mon Feb 08, 2021 5:35 pm
by stvitaly
If someone encounters this in the future - the root case for the above relevant to a GPO section:
Computer Configuration → Administrative Templates→ System→ Device Installation→ Device Installation Restrictions.
The problem itself relevant to the fact that policy: "Allow administrators to override Device Installation Restrictions" does not count system account as an administrator account.
In case you have restricted device installation for non-admins and you are trying to use system account to create and use virtual interfaces (which you type of must to do to use wintun) your device creation will be blocked with this error unless added to an exception in other policy in the section (for example I used "Device Installation Restrictions: Allow installation of devices uses drivers that match these device setup classes")