Intel AVB Filter Driver - Complete Installation Guide

Prerequisites

System Requirements

Windows 10 version 1809+ or Windows 11
Intel Ethernet Controller (I210, I217, I219, I225, I226, I225, or I226)
Administrator privileges
Visual Studio 2019+ with Windows Driver Kit (WDK) for development

Installation Methods

There are three ways to install this driver, depending on your scenario:

Method 1: Test Signing (Development/Testing) — RECOMMENDED FOR TESTING

Method 2: Self-Signed Certificate with Local Trust

Method 3: Production Signing (WHQL/EV Certificate)

Where do the driver files come from?

GitHub Release (recommended): download IntelAvbFilter-vX.Y-windows-x64.zip from the Releases page and extract it.

Build from source: run tools\build\Build-Driver.ps1 -Configuration Release — output lands in build\x64\Release\IntelAvbFilter\.
The canonical install entry point is always tools\setup\Install-Driver.ps1, which locates the built artifacts automatically.

Method 1: Test Signing Mode (Development/Testing)

This is the easiest method for development and testing. Windows will accept test-signed drivers.

Step 1: Enable Test Signing Mode

Open PowerShell or Command Prompt as Administrator:

# Enable test signing
bcdedit /set testsigning on

# Verify it's enabled
bcdedit /enum {current}
# Look for "testsigning                 Yes"

# REBOOT REQUIRED
shutdown /r /t 0

After reboot, you should see "Test Mode" watermark in the bottom-right corner of your desktop.

Step 2: Verify Test Signing Status

bcdedit /enum {current} | findstr /i "testsigning"
# Should show: testsigning              Yes

Step 3: Install the Driver

Easiest — use the install script (handles pnputil + certificate automatically):

# From the repo root (after building or extracting a release ZIP)
powershell -ExecutionPolicy Bypass -File tools\setup\Install-Driver.ps1 -Configuration Release -Action InstallDriver

Manual alternative (if running from an extracted release ZIP):

# Navigate to the extracted driver folder
cd IntelAvbFilter   # folder created by Expand-Archive

# Install via pnputil
pnputil /add-driver IntelAvbFilter.inf /install

# Alternative for NDIS filter drivers
netcfg -v -l IntelAvbFilter.inf -c s -i MS_IntelAvbFilter

Note: x64\Debug\IntelAvbFilter\ is a local MSBuild output folder — it is not present in the cloned repo. Always build first or use a release ZIP.

Step 4: Verify Installation

# Check if the driver loaded
sc query IntelAvbFilter

# Check device manager for the filter
Get-NetAdapter | Select Name, InterfaceDescription

# Verify device node creation
ls \\.\IntelAvbFilter -ErrorAction SilentlyContinue

Step 5: Check Driver Logs

# View debug output (requires DebugView from Sysinternals)
# Download: https://docs.microsoft.com/en-us/sysinternals/downloads/debugview
# Run DebugView as Administrator and enable "Capture Kernel"

Method 2: Self-Signed Certificate with Local Trust

If you don't want the "Test Mode" watermark, you can create and trust your own certificate.

Step 1: Create Self-Signed Certificate

Open PowerShell as Administrator:

# Create a certificate for code signing
$cert = New-SelfSignedCertificate -Type CodeSigningCert `
    -Subject "CN=IntelAvbFilter Development" `
    -KeyUsage DigitalSignature `
    -FriendlyName "IntelAvbFilter Driver Certificate" `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}")

# Export the certificate
$password = ConvertTo-SecureString -String "YourPassword" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath "C:\IntelAvbFilter_Cert.pfx" -Password $password
Export-Certificate -Cert $cert -FilePath "C:\IntelAvbFilter_Cert.cer"

# Display certificate details
$cert | Format-List Subject, Thumbprint, NotBefore, NotAfter

Step 2: Install Certificate in Trusted Stores

# Import certificate to Trusted Root Certification Authorities
Import-Certificate -FilePath "C:\IntelAvbFilter_Cert.cer" -CertStoreLocation "Cert:\LocalMachine\Root"

# Import certificate to Trusted Publishers (required for driver installation)
Import-Certificate -FilePath "C:\IntelAvbFilter_Cert.cer" -CertStoreLocation "Cert:\LocalMachine\TrustedPublisher"

# Verify installation
Get-ChildItem -Path "Cert:\LocalMachine\Root" | Where-Object {$_.Subject -like "*IntelAvbFilter*"}
Get-ChildItem -Path "Cert:\LocalMachine\TrustedPublisher" | Where-Object {$_.Subject -like "*IntelAvbFilter*"}

Step 3: Sign the Driver with Your Certificate

You need to re-sign the driver package with your certificate.
First, build the driver (output is in build\x64\Release\IntelAvbFilter\) or extract a release ZIP.

# Set paths
$certPath     = "C:\IntelAvbFilter_Cert.pfx"
$certPassword = "YourPassword"
$driverDir    = ".\build\x64\Release\IntelAvbFilter"   # adjust to extracted ZIP dir if applicable

# Locate signtool from WDK
$signtool = (Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin" -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue | Select-Object -Last 1).FullName

# Sign the driver .sys file
& $signtool sign /v /f $certPath /p $certPassword /t http://timestamp.digicert.com "$driverDir\IntelAvbFilter.sys"

# Sign the catalog file
& $signtool sign /v /f $certPath /p $certPassword /t http://timestamp.digicert.com "$driverDir\IntelAvbFilter.cat"

# Verify signatures
& $signtool verify /v /pa "$driverDir\IntelAvbFilter.sys"

Step 4: Install the Driver

Easiest — use the install script:

powershell -ExecutionPolicy Bypass -File tools\setup\Install-Driver.ps1 -Configuration Release -Action InstallDriver

Manual alternative:

$driverDir = ".\build\x64\Release\IntelAvbFilter"  # or extracted ZIP folder
pnputil /add-driver "$driverDir\IntelAvbFilter.inf" /install

# NDIS filter alternative
netcfg -v -l "$driverDir\IntelAvbFilter.inf" -c s -i MS_IntelAvbFilter

Method 3: Production Signing (WHQL/EV Certificate)

For production deployment, you need a Windows Hardware Quality Labs (WHQL) signature or EV certificate.

Requirements

EV Code Signing Certificate from a trusted CA (DigiCert, GlobalSign, etc.)
Windows Hardware Lab Kit (HLK) for WHQL testing
Microsoft Partner Center account for driver submission

Process Overview

Purchase EV Code Signing Certificate (~$200-400/year)
Sign driver with EV certificate
Submit to Microsoft Partner Center for WHQL certification
Receive signed driver package from Microsoft
Distribute to end users

For detailed instructions, see: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/

Troubleshooting Common Installation Issues

Issue 1: "Driver is not signed" Error

Symptoms: Installation fails with certificate or signature error

Solution:

# 1. Verify test signing is enabled
bcdedit /enum {current} | findstr /i "testsigning"
# Should show: testsigning              Yes

# 2. If not enabled, enable and reboot
bcdedit /set testsigning on
shutdown /r /t 0

# 3. After reboot, verify "Test Mode" watermark appears

Issue 2: Certificate Already Installed but Still Fails

Symptoms: Certificate is in store but driver won't install

Solution:

# 1. Remove old certificates
Get-ChildItem -Path "Cert:\LocalMachine\Root" | Where-Object {$_.Subject -like "*IntelAvbFilter*"} | Remove-Item
Get-ChildItem -Path "Cert:\LocalMachine\TrustedPublisher" | Where-Object {$_.Subject -like "*IntelAvbFilter*"} | Remove-Item

# 2. Re-import to BOTH stores
Import-Certificate -FilePath "C:\IntelAvbFilter_Cert.cer" -CertStoreLocation "Cert:\LocalMachine\Root"
Import-Certificate -FilePath "C:\IntelAvbFilter_Cert.cer" -CertStoreLocation "Cert:\LocalMachine\TrustedPublisher"

# 3. Verify certificates are present
certlm.msc
# Navigate to: Trusted Root Certification Authorities > Certificates
# Navigate to: Trusted Publishers > Certificates
# Ensure your certificate appears in BOTH locations

Issue 3: Driver Loads but Device Node Not Created

Symptoms: Installation succeeds but \\.\IntelAvbFilter doesn't exist

Possible Causes:

No Intel hardware detected - Driver only loads on systems with supported Intel Ethernet controllers
Wrong VID/DID - Your Intel controller isn't in the supported list

Solution:

# Check your Intel Ethernet adapter hardware ID
Get-NetAdapter | ForEach-Object {
    $deviceID = (Get-PnpDevice -InstanceId $_.PnPDeviceID).HardwareID
    [PSCustomObject]@{
        Name = $_.InterfaceDescription
        HardwareID = $deviceID
    }
}

# Look for Intel devices (VEN_8086)
# Example: PCI\VEN_8086&DEV_15F3  (I219 controller)

If your Intel controller's Device ID (DEV_xxxx) isn't in the supported list, you'll need to add it to the INF file.

Issue 4: "Object reference not set to an instance of an object" Build Error

Symptoms: Build completes but shows this error during post-build signing

Cause: Visual Studio WDK deployment configuration issue

Solution: This is a cosmetic error in the WDK tooling and doesn't affect the driver. You can safely ignore it if:

Build shows "1 succeeded, 0 failed"
IntelAvbFilter.sys is created
Driver package is signed successfully

To fix the error:

Open Visual Studio ? Project Properties
Navigate to: Driver Install ? Deployment
Remove any invalid target computer configurations
Disable deployment if you're not using remote test machines

Issue 4A: "No connection could be made because the target machine actively refused it"

Symptoms: Build succeeds but shows deployment connection error:

Error: 10061 (ConnectionRefused)
Error message: No connection could be made because the target machine actively refused it 127.0.0.1:50005

Cause: Visual Studio is trying to deploy/test on a remote machine that doesn't exist

Solution 1 - Use Fix Script:

.\fix_deployment_config.ps1

Solution 2 - Manual Fix in Visual Studio:

Right-click IntelAvbFilter project ? Properties
Navigate to: Configuration Properties ? Driver Install ? Deployment
UNCHECK "Enable deployment"
UNCHECK "Remove previous driver versions before deployment"
Click Apply ? OK
Rebuild Solution

Solution 3 - Clean Visual Studio Cache:

# Close Visual Studio first!
cd .
Remove-Item -Path ".vs" -Recurse -Force
# Reopen Visual Studio and rebuild

Note: This error doesn't affect the compiled driver. The driver is still built successfully and can be installed normally.

Issue 5: "Cannot find file" during netcfg

Symptoms: netcfg -l IntelAvbFilter.inf fails with "file not found"

Solution:

# Use absolute path
netcfg -v -l ".\x64\Debug\IntelAvbFilter\IntelAvbFilter.inf" -c s -i MS_IntelAvbFilter

# Verify all required files are present
ls ".\x64\Debug\IntelAvbFilter"
# Should show: IntelAvbFilter.inf, IntelAvbFilter.sys, IntelAvbFilter.cat

Uninstalling the Driver

Uninstall using pnputil

# List installed drivers
pnputil /enum-drivers | findstr /i "IntelAvbFilter"

# Uninstall by published name (example: oem123.inf)
pnputil /delete-driver oem123.inf /uninstall /force

Uninstall using netcfg

# Remove the filter service
netcfg -v -u MS_IntelAvbFilter

Disable Test Signing (Optional)

# Disable test signing
bcdedit /set testsigning off

# Reboot
shutdown /r /t 0

Verifying Installation Success

1. Check Driver Service Status

# Query service
sc query IntelAvbFilter
# Should show: STATE: 4 RUNNING

# Or using Get-Service
Get-Service -Name IntelAvbFilter

2. Check Device Node

# Verify device node creation (requires Intel hardware)
[System.IO.File]::Exists("\\.\IntelAvbFilter")
# Should return: True

# Try opening device
$handle = [System.IO.File]::Open("\\.\IntelAvbFilter", [System.IO.FileMode]::Open, [System.IO.FileAccess]::ReadWrite, [System.IO.FileShare]::ReadWrite)
$handle.Close()
# Should succeed if Intel hardware is present

3. Check Event Viewer

# Open Event Viewer
eventvwr.msc

# Navigate to: Windows Logs ? System
# Filter by: Source = "IntelAvbFilter"
# Look for informational events indicating successful load

4. Use DebugView for Kernel Debug Output

Download DebugView: https://docs.microsoft.com/en-us/sysinternals/downloads/debugview
Run as Administrator
Enable: Capture ? Capture Kernel
Filter: Edit ? Filter/Highlight ? "IntelAvb"
Look for initialization messages:
```
IntelAvb: Intel device registry initialized with full IGB support
IntelAvb: Modern: I210, I217, I219, I226, I350, I354
IntelAvb: Legacy: 82575, 82576, 82580
```
Note on the device list in these log lines: The initialization log reflects the raw IGB register-family detection table inherited from the Intel igb driver lineage. I350, I354, 82575, 82576, and 82580 are not supported or tested — they lack the IEEE 802.1 AVB/TSN hardware features (launch-time scheduler, CBS, hardware PTP) required by this driver. The only controllers with verified or code-ready support are listed in the README Supported Controllers table: I226 (verified), I225, I219, I210, I217 (code-ready, unverified).

Testing the Driver

Basic Connectivity Test

# Run the AVB test application
cd ".\tools\avb_test"
.\avb_test.exe

# Expected output:
# Opening device \\.\IntelAvbFilter...
# Device opened successfully
# Intel device count: 1
# Device 0: VID=0x8086, DID=0x15F3, Capabilities=0x000000C3

IOCTL Test

# Test device enumeration
.\avb_test.exe enum

# Test register access
.\avb_test.exe read 0x00000

# Test PTP clock
.\avb_test.exe ptp

Building from Source

If you need to rebuild the driver:

Prerequisites

Visual Studio 2019 or later
Windows Driver Kit (WDK) 10.0.19041 or later
Windows SDK 10.0.22000 or later

Build Steps

# Clone repository
git clone --recursive https://github.com/zarfld/IntelAvbFilter.git
cd IntelAvbFilter

# Open solution in Visual Studio
start IntelAvbFilter.sln

# Or build from command line
msbuild IntelAvbFilter.sln /p:Configuration=Debug /p:Platform=x64

# Build output location:
# x64\Debug\IntelAvbFilter\IntelAvbFilter.sys

Advanced Configuration

Changing Debug Output Level

Edit flt_dbg.h and modify DBG_INIT_LEVEL:

// Debug levels:
// DL_NONE   = 0  (No output)
// DL_ERROR  = 1  (Errors only)
// DL_WARN   = 2  (Warnings + Errors)
// DL_INFO   = 3  (Info + Warnings + Errors)
// DL_TRACE  = 4  (Everything)

#define DBG_INIT_LEVEL  DL_INFO  // Change to desired level

Rebuild and reinstall the driver.

Security Considerations

Test Signing Risks

Test Mode reduces security - any test-signed driver can load
Use only in development/test environments
Disable test signing in production systems

Self-Signed Certificate Risks

Less secure than WHQL - no Microsoft validation
Requires manual trust installation on each machine
Suitable for internal/corporate deployments only

Production WHQL Benefits

Microsoft validation - driver passes quality tests
Automatic trust - no manual certificate installation
Windows Update delivery - seamless deployment
Required for most enterprises and OEM scenarios

Getting Help

Common Resources

WDK Documentation: https://docs.microsoft.com/en-us/windows-hardware/drivers/
NDIS Driver Development: https://docs.microsoft.com/en-us/windows-hardware/drivers/network/
Driver Signing: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing

Project-Specific Help

GitHub Issues: https://github.com/zarfld/IntelAvbFilter/issues
Build Logs: Check x64\Debug\build.log
Debug Output: Use DebugView (see above)

Quick Reference Card

Enable Test Signing

bcdedit /set testsigning on
shutdown /r /t 0

Install Driver

netcfg -v -l IntelAvbFilter.inf -c s -i MS_IntelAvbFilter

Uninstall Driver

netcfg -v -u MS_IntelAvbFilter

Disable Test Signing

bcdedit /set testsigning off
shutdown /r /t 0

Check Installation

sc query IntelAvbFilter
Get-NetAdapter | Select Name, InterfaceDescription

Note: This driver is currently in development/testing phase. For production deployment, obtain proper WHQL certification from Microsoft.

Uh oh!

FilesExpand file tree

installation-guide.md

Latest commit

History

installation-guide.md

File metadata and controls

Intel AVB Filter Driver - Complete Installation Guide

Prerequisites

System Requirements

Installation Methods

Method 1: Test Signing (Development/Testing) — RECOMMENDED FOR TESTING

Method 2: Self-Signed Certificate with Local Trust

Method 3: Production Signing (WHQL/EV Certificate)

Method 1: Test Signing Mode (Development/Testing)

Step 1: Enable Test Signing Mode

Step 2: Verify Test Signing Status

Step 3: Install the Driver

Step 4: Verify Installation

Step 5: Check Driver Logs

Method 2: Self-Signed Certificate with Local Trust

Step 1: Create Self-Signed Certificate

Step 2: Install Certificate in Trusted Stores

Step 3: Sign the Driver with Your Certificate

Step 4: Install the Driver

Method 3: Production Signing (WHQL/EV Certificate)

Requirements

Process Overview

Troubleshooting Common Installation Issues

Issue 1: "Driver is not signed" Error

Issue 2: Certificate Already Installed but Still Fails

Issue 3: Driver Loads but Device Node Not Created

Issue 4: "Object reference not set to an instance of an object" Build Error

Issue 4A: "No connection could be made because the target machine actively refused it"

Issue 5: "Cannot find file" during netcfg

Uninstalling the Driver

Uninstall using pnputil

Uninstall using netcfg

Disable Test Signing (Optional)

Verifying Installation Success

1. Check Driver Service Status

2. Check Device Node

3. Check Event Viewer

4. Use DebugView for Kernel Debug Output

Testing the Driver

Basic Connectivity Test

IOCTL Test

Building from Source

Prerequisites

Build Steps

Advanced Configuration

Changing Debug Output Level

Security Considerations

Test Signing Risks

Self-Signed Certificate Risks

Production WHQL Benefits

Getting Help

Common Resources

Project-Specific Help

Quick Reference Card

Enable Test Signing

Install Driver

Uninstall Driver

Disable Test Signing

Check Installation