Access to the kernel driver is restricted 0x0000000

[Ledi04]

[jxy-s]

Capture a trace of the issue reproducing, this will help me identify what is happening:

• open an elevated command prompt
• execute: logman create trace ksi -p {F64B58A2-8214-4037-8C7D-B96CE6098F3D} 0xffffffff 0xff -bs 64 -nb 16 128 -o "kph.etl" -v mmddhhmm -ow
• execute: logman start ksi
• reproduce the issue
• execute: logman stop ksi
• execute: logman delete -n ksi
• collect the kph_nnnnnnnn.etl from disk
• attach the .etl file here or email it to me

[Ledi04]

I have run the canary setup exe with „RunAsTI“ and it showed me nothing. I enabled kernel driver in the settings, but i‘m not sure if it is running. Hoe can i check

[Ledi04]

I think I will do it tomorrow.

[jxy-s]

@Ledi04 if you're using the portable files (not the setup installer), could you try rebooting and see if the issue continues to reproduce?

[Ledi04]

@jxy-s i tried with portable files but the still "Access to the kernel driver is restricted 0x0000000" will apear. But when i enable LSA protection

Open the Registry Editor, or enter RegEdit.exe in the Run dialog, and then go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry key.
Open the RunAsPPL value, and edit its data:
To configure the feature with a UEFI variable, use a type of dword and a data value of 00000001.
To configure the feature without a UEFI variable, use a type of dword and a data value of 00000002. This value is only enforced on Windows 11 build 22H2 and later.

"https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#enable-lsa-protection-on-a-single-computer"

I set "RunAsPPL" to 2.

Nothing apeared! I deleted the portable files and extracted them again. But still nothing apeared. How can i check if ernel mode driver is working or not?

I'm trying to use "https://github.com/Hyyote/DARKSTAR" A self-contained game optimizer with intelligent thread detection, but it will show me " ? Failed to connect to Process Hacker kernel port
? Kernel driver not available - using user-mode (limited on protected processes)
For full functionality, run Process Hacker with kernel driver enabled"

[jxy-s]

I set "RunAsPPL" to 2.

The error in your screenshot is unrelated to LSA protection.

I tried with portable files

Try rebooting the computer.

I'm trying to use "https://github.com/Hyyote/DARKSTAR" A self-contained game optimizer with intelligent thread detection, but it will show me " ? Failed to connect to Process Hacker kernel port
? Kernel driver not available - using user-mode (limited on protected processes)
For full functionality, run Process Hacker with kernel driver enabled"

System Informer kernel driver is not designed to work with that project. Their client will not authenticate unless the machine is in debug configuration. Their DarkstarDriver.sys kernel driver is unsigned. Looks like your open issue with them is going unanswered. That project probably requires the machine to be configured to be in debug mode and to allow unsigned drivers to load. I can't help you further with DARKSTAR, sorry.

[Ledi04]

[Ledi04]

where to find the kph_nnnnnnnn.etl

[jxy-s]

where to find the kph_nnnnnnnn.etl

The same location that you ran logman from.

[jxy-s]

The ++ in the title bar tells me it is running and connected to the driver with full access. It looks like the problem is resolved?

[Ledi04]

its buggy. With the portable files it sometime appeared when i tried to load it with this settings and it worked I think.

[Ledi04]

with this settings the alternate method will work

[jxy-s]

with this settings the alternate method will work

Something is interfering with the driver load. Consider removing other software that is preventing, conflicting, or blocking the driver from starting.

systeminformer/SystemInformer/ksisup.c

Lines 1590 to 1605 in 65753d0

	//
	// Malware might be blocking the driver load. Offer the user a chance
	// to try again with a different method.
	//
	if (PhShowKsiMessage2(
	WindowHandle,
	TD_YES_BUTTON | TD_NO_BUTTON,
	TD_SHIELD_ERROR_ICON,
	status,
	FALSE,
	L"Unable to load kernel driver",
	L"Try again with alternate driver load method?"
	) != IDYES)
	{
	goto CleanupExit;
	}

[Ledi04]

Malware might be blocking the driver load? I have maybe malware????!!!