MDT 2010 / Windows 7, driver ranking problem for Realtek HD Audio

[morganw]

I've just come across an unexpected problem while setting up drivers for a migration to Windows 7 (32bit Enterprise) via MDT2010. On the first model of computer that i'm working on it seems impossible to install an unsigned driver from Realtek due to it always having a lower driver ranking than the signed Microsoft HD Audio driver (which doesn't seem to be able to actual produce any sound). The deployment process will install unsigned drivers without any problem as the Radeon graphics driver was unsigned and installed with no problems.

Is there any way to allow unsigned drivers to have an equal ranking in the selection process so that newer driver / best match would be installed rather than a signed driver that doesn't actually work? Or am i missing something else for the Microsoft HD Audio driver to function properly?

[SYNACK]

Where did you find unsigned Realtek drivers, can you post the device ID or the motherboard type as there are generally more up to date signed drivers avalible.

[morganw]

I got them from the Realtek website (latest version). In the driver bundle that you download in the 'HD Audio' range you get about 20 or 30 different .inf driver definitions, only two aren't WHQL signed. My hardware matches one of these.

Hardware IDs:
HDAUDIO\FUNC_01&VEN_10EC&DEV_0880&SUBSYS_10430000& REV_1008
HDAUDIO\FUNC_01&VEN_10EC&DEV_0880&SUBSYS_10430000

Motherboard:
ASUSTeK Computer INC.
P5RD2-TVM/GB/1394 (This is an OEM board found in an RM Ascend 2020b, RM don't have a signed driver for it either)

[sted]

could you add it as an application and run the exe file as part of the install?

[morganw]

As an MDT application is doesn't work, it's installshield based but doesn't respect /s /sms properly, plus it pops up a dialogue box asking for confirmation for the installation of an unsigned driver.

[SYNACK]

How many of the offending machines do you have, if you have a few it may be worth doin a specialised image for them and sysprep it using the keep drivers setting in an answer file. Not good for single image nirvana but may be quicker and easier.

[morganw]

There aren't a lot of them, probably about 30 which are mainly in offices rather than in IT rooms. I'm actually installing straight from the original WIM image from the Windows 7 install disc, we've got so many different types of PC that I was really relying on the driver injection to work. Hopefully this is a one off but i'm slightly worried because there are a few more models that are even older than this one. It justs seems an odd position to be in where a working driver is rejected in favour of one that doesn't work.

[PiqueABoo]

I'm actually installing straight from the original WIM image from the Windows 7 install disc

Begs an obvious question then: Can this specific signed trumps unsigned behaviour be turned off via local registry fiddling and would your driver definitely "win" then? If so then you've got WAIK installed, so try an offline edit to get that in the WIM's registry and if it works why not use that WIM to build everything? GPO can put the behaviour back post-build if you really want it back.

[morganw]

I don't think it is possible from what I've read about it today, signed drivers always beat a non-signed driver. There is a registry key that levels the playing field between WHQL drivers and ones that use other certification, off by default in Vista, on by default in W7 but nothing in the way of an over-ride for something that is unsigned. Also I think it's part of the security design of Windows 7 to never allow an unsigned driver to be installed by a user or script without prompting for user confirmation, leading onto the 64bit version that doesn't allow them anyway. I did consider trying to remove the Microsoft HD Audio driver from the WIM and then putting it back in where required through MDT driver injections, not sure of the ramifications of doing that though...

[Arthur]

In MDT, driver dates are used to compare signed drivers, not versions so you could still end up with an older driver "winning" if its date is newer. Have you tried any of the Realtek drivers from this website? There should be at least one that is signed and works with your motherboard.

Another option would be to sign the unsigned driver yourself...

http://technet.microsoft.com/en-us/l...52(WS.10).aspx
http://blog.didierstevens.com/2008/1...-with-openssl/

[morganw]

The current driver version is 2.60, I managed to find a download link for 2.25. Everything was the same inside the download, pretty much everything signed except the one that I need. I don't think there is a way to insert a certificate and trust settings into a wim file (and anything via group policy would be coming in too late?) so I wouldn't be able to have a self-signed driver installed through an injection, but possibly could run it through a silent install at a later stage. I think I'll have to work through all the various types of PC and see if similiar problems occur, then make a decision based on that.

[sted]

long shot could you use something like winstall and make the install package into an msi and deploy via ad to the pcs that need it?

[morganw]

It might be worth a try although I imagine there are safe guards to prevent the use of drivers which suddenly appear from nowhere, I might also try a scripted silent install with a hard coded timer to allow the setup to run and finish properly.

[morganw]

I just found that we have two IT rooms using this motherboard, looks like I'll have to look at self signing the drivers and then scripting them on.
This is the official line from the RM website regarding the driver:

Please note: The driver cat file for the ALC880 is not signed and you may receive a warning when running setup.exe. No signed driver is available for the ALC880. RM systems containing the ALC880 codec were not shipped pre-installed with Vista and this driver is suitable for systems being upgraded from Microsoft® Windows® XP only.

I guess that means that no signed driver exists.