VMware Tools upgrade fails on Windows without SHA-2 code signing support

Products

• VMware vSphere ESXi

Issue/Introduction

• The VM Tools installer displays the following message: "Setup failed to install xxx driver automatically.  This driver will have to be installed manually".
• A Windows Security warning may precede the message: "Windows can't verify the publisher of this driver software".
• In the vminst.log file, one of the following messages are seen:

"Signature verification failed while checking integrity of driver package 'x.inf"

"Driver x.inf was signed by UNTRUSTED root, will recheck"

Environment

VMware Tools 11.x

Cause

Microsoft has changed Windows driver signing to use the SHA-2 algorithm exclusively starting December 3, 2019. Legacy Windows systems without SHA-2 code signing support will fail driver signature verification, for more information see UPDATE: Hardware Partner Center – SHA 1 signing deprecation notice.

Resolution

1. Follow 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
2. Download and install the required Windows updates available at SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: September 23, 2019  and  Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: March 12, 2019 on Windows 7 SP1 & Windows Server 2008 R2 SP1.

Note: The following driver packages updated in VMware Tools version 11.1.0 are signed by Microsoft using SHA-2.

vnetwfp.inf
vsepflt.inf
giappdef.inf
vmhgfs.inf
vm3d.inf

 

• If other drivers change in future VMware Tools releases, they will also be signed by Microsoft using SHA-2.
• When building a new Windows 7 SP1 or Windows Server 2008 R2 SP1 VM from scratch, you can still possibly use VMware Tools version 11.1.0, as its pvscsi & vmxnet3 driver packages were signed using SHA-1 before.
• If using a vmxnet3 device and VMware Tools version 11.1.0 cannot be installed, due to a network connection because some other driver fails the installation, follow the below sequence:
  1. Start with VMware Tools version 11.0.6.
  2. Upgrade Windows.
  3. Upgrade to the latest VMware Tools version.