Unbinding The Lightweight Filter (LWF)

NOTE - THIS PAGE FORMS PART OF THE INSTRUCTIONS FOR SETTING UP WINDOWS TO BOOT FROM A STORAGE AREA NETWORK (SAN) USING EITHER THE AoE OR iSCSI PROTOCOLS.

Note - This section does not apply if installing Windows directly to an iSCSI target or diskless booting Windows NT 5.*.

The Windows Filtering Platform (WFP) Lightweight Filter (LWF) enables packet filtering, connection monitoring, etc. A wfplwf binding is automatically applied to any network adapters present on the Client system - unfortunately this will cause issues if attempting to diskless boot a cloned operating system using either the iSCSI or AoE protocols.

This information in this section has been adapted from Microsoft Knowledgebase article 976042 (see here). KB976042 refers to iSCSI network boot failures following changes of hardware, however it can be applied to iSCSI and AoE diskless booting of Windows NT 6.* systems cloned from existing installations.

Without applying the fix detailed below you are likely to experience either of the following issues when diskless booting iSCSI/AoE from a cloned Operating System -

The following has been copied from the KB976042 article - which refers to Windows Server 2008 R2. It also applies to other Windows NT 6.* Operating Systems (including Windows 7 (SP1) and Windows 8.1) when diskless booting iSCSI and AoE -

"...In Windows Server 2008 R2, a new NDIS Light Weight Filter (LWF) driver is introduced called “WFP Lightweight Filter”. When Windows is installed on a local disk, this filter driver is installed and bound to all network adapters, including the network adapter to be used for iSCSI boot. If Windows is installed directly on an iSCSI disk, Windows Setup makes sure that the LWF driver does not get installed on the network adapter used with iSCSI boot. If, however, there are secondary iSCSI boot adapters (like in a fail-over environment) in the machine that are not configured for such roles during the Windows installation (e.g. an iSCSI Bios Firmware Table (iBFT) is not presented at install time or such devices are added later), the LWF driver is installed and bound on all such secondary or fail-over devices.

The NDIS LWF driver is neither a boot-start driver nor is it compatible with paging I/O. When any of the above systems, where NDIS LWF driver is bound to an iSCSI boot adapter, are started, Windows may fail to boot and/or causes a bugcheck 0x7B (INACCESSIBLE_BOOT_DEVICE)..."

The KB976042 article suggests applying a hotfix to resolve this issue, however the hotfix only applies to Windows Server 2008 R2. Fortunately a workaround is also provided -

"...To work around this issue without applying the hotfix, before creating an iSCSI bootable Windows image to be deployed on an iSCSI target or after configuring the secondary/fail-over boot-adapters, unbind NDIS LWF driver from any network adapters being used for iSCSI boot.

NDIS LWF driver can be unbound from the target miniport via BindView or NvspBind (among other tools). ..."

Applying the Fix

The instructions in the following section apply to unbinding the NDIS Light Weight Filter (LWF) driver using the command-line nvspbind.exe tool. The process is slightly different for Windows 7 and Windows 8.1 - the differences are covered below. Download nvspbind.exe from here (direct downloads - 32-bit / 64-bit).

Now follow the instructions below before cloning the disk!

Step 1

Run the following command to obtain a list of all network adapters with corresponding GUID values -

Sample output from running the nvspbind.exe /n command -

Isolate the entry for the network adapter you plan to use to connect to the server. E.g. -

The adapter's GUID is listed in the first line of the network adapter entry - in this example it's {1A81A481-1441-4551-A278-09783572F70C}.

Step 2

Having identified the network adapter's GUID in the proceeding step ({1A81A481-1441-4551-A278-09783572F70C}) we can use this to list any bindings by running the following command (editing the GUID value to reflect your own setup) -

Sample output from running the nvspbind.exe {1A81A481-1441-4551-A278-09783572F70C} command -

As we can see from this output, there's an entry for the WFP Lightweight Filter Driver currently enabled on this adapter -

NOTE - on Windows 8 and newer systems the ms_wfplwf entry has been replaced with ms_wfplwf_lower and/or ms_wfplwf_upper. E.g. -

Step 3

Having discovered in the proceeding step that the WFP Lightweight Filter Driver is attached to the system we need to disable the binding. Run the following commands (editing the GUID value to reflect your own setup) -

Or on Windows 8 and newer systems, with ms_wfplwf_lower and/or ms_wfplwf_upper bindings -

Output from running the above commands (ms_wfplwf)-

Output from running the above commands (ms_wfplwf_lower and ms_wfplwf_upper) -

Step 4

Rerun the command in step 2 to recheck bindings (e.g. nvspbind.exe {1A81A481-1441-4551-A278-09783572F70C}) -

Sample output from (re)running the nvspbind.exe {1A81A481-1441-4551-A278-09783572F70C} command -

As you can see from the above output the ms_wfplwf binding has been successfully disabled.

On a Windows 8.1 system the ms_wfplwf_upper binding was displayed as been successfully disabled. The ms_wfplwf_lower binding remained enabled, however this did not appear to impact on successfully booting Windows 8.1 using a diskless AoE boot.

Document date - 28th February 2017(DRAFT)