Error in creating TAP interface

[stvitaly]

I am trying to install openvpn manually on machines, as a part of installation since of openVPN 2.5 I need to install TAP drivers first and then use tapctl to create the device itself.
It works totally fine on most of the devices, but there is an error I got from number of machines (not sure what triggered it on those ones specifically).

Driver installation is looking OK:

View Originaldriver install

1

pnputil -i -a OemVista.inf

2

3

Microsoft PnP Utility

4

5

6

7

Processing inf : OemVista.inf

8

9

Successfully installed the driver.

10

11

Driver package added successfully.

12

13

Published name : oem202.inf

14

15

16

17

18

19

Total attempted: 1

20

21

Number successfully imported: 1

22

1

pnputil -i -a OemVista.inf

2

Microsoft PnP Utility

3

Processing inf : OemVista.inf

4

Successfully installed the driver.

5

Driver package added successfully.

6

Published name : oem202.inf

7

Total attempted: 1

8

Number successfully imported: 1

But then on a small percentage of machines I get an error:

View Originaldevice creation

1

tapctl.exe create

2

3

tap_create_adapter: DiInstallDevice failed

4

5

Error 0xe0000248

6

7

Creating TUN/TAP adapter failed (error 0xe0000248).

8

1

tapctl.exe create

2

tap_create_adapter: DiInstallDevice failed

3

Error 0xe0000248

4

Creating TUN/TAP adapter failed (error 0xe0000248).

Tried to google the error and got that it means:
ERROR_DEVICE_INSTALL_BLOCKED
Any ideas what can be a reason?

[TinCanTech]

Probably your version of Windows ..

[stvitaly]

If someone encounters this in the future - the root case for the above relevant to a GPO section:
Computer Configuration → Administrative Templates→ System→ Device Installation→ Device Installation Restrictions.
The problem itself relevant to the fact that policy: "Allow administrators to override Device Installation Restrictions" does not count system account as an administrator account.
In case you have restricted device installation for non-admins and you are trying to use system account to create and use virtual interfaces (which you type of must to do to use wintun) your device creation will be blocked with this error unless added to an exception in other policy in the section (for example I used "Device Installation Restrictions: Allow installation of devices uses drivers that match these device setup classes")