Rapid Recovery Install completes with "A digitally signed driver is required" warning on Windows 2016/Windows 10 with Secure Boot Enabled (4043762)

This issue affects any Rapid Recovery 6.1.x product installed on Windows 10 or Windows Server 2016 server with EFI and Secure Boot enabled.

After installer completes a windows will pop up stating "A digitally signed driver is required." After reboot of server the drivers listed in the warning will not start and cannot be started.

Example from an Agent install:

Or, after agent installation, server's reboot goes into OS repair request/loop, claiming a driver file, such as aavolflt.sys, is corrupt.

Note: sometimes, driver installation attempt may cause a Blue Screen of Death (BSoD) on machines with UEFI Secure Boot enabled.

Windows 10 and Windows Server 2016 with EFI and Secure Boot enabled is having problems with digitally signed drivers from many vendors as Windows 10 and Windows 2016 introduced a new way of signing drivers.

Rapid Recovery drivers have been submitted to Microsoft for certification and will be made available as soon as Microsoft completes the process.

Defect ID RR-101573 has been assigned to this issue.

Windows Registry Disclaimer:

Quest does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.

Solution:

Certified drivers will be included in the Rapid Recovery 6.2 and newer.  Experimental drivers are available for 6.1.x builds. Please open a service request to receive them.

Work Around:

Disable Secure Boot:

1. Physical servers: Consult with your IT administrator to disable Secure Boot in the system's UEFI Firmware. This is usually done in the BIOS. Guidelines for disabling or enabling Secure Boot may be found here.
2. Virtual servers:
   1. Hyper-V virtual machines: Disable Secure Boot in the VM's Firmware or Security settings.
   2. ESXi virtual machines: Disable Secure Secure Boot in the VM's Boot Options.

If services do not start after Secure Boot is disabled, check their start value in the registry. Some drivers may be disabled by the OS at installation time. If this is the case, they need to be re-enabled:

1. Open RegEdit and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.
2. Check the values of the AAFileFilter, AAFsFlt, AAVolFlt, AAVDisk, AAVStor registry keys and compare to the values in the Start Values Table. Depending on the installation, some may be missing. This is by design. This operation is needed as some of the drivers may be disabled by the OS at installation and need to be re-enabled.
3. After changing any of the values below to 0 (this applies to AAFileFilter, AAFsFlt, AAVolFlt only), a reboot is required. It is recommended to check/change the values before starting disabling Secure Boot.

NOTE: You may find the values for the registry subkeys match, in which case disabling Secure Boot should be the effective step to complete the work around.

Start Values Table: