NPcap upgrade from 1.85 → 1.86 intermittently fails with exit code 2

[vitezslav-popovsky-solarwinds]

Describe the bug
NPcap OEM 1.86 silent upgrade fails randomly with exit code 2
With the following error in the install.log

File: overwriteflag=0, allowskipfilesflag=0, name="NPFInstall.exe"
File: error creating "C:\Program Files\Npcap\NPFInstall.exe"
File: error, user abort

To Reproduce

1. Uninstall npcap (Uninstall.exe /S)
2. Install 1.85 with the above options
3. Install 1.86 with the above options
4. Repeat until failure (loop)

Expected behavior
Npcap 1.86 should install successfully during the upgrade process without errors, handling file operations reliably and completing the installation in a consistent and resilient manner.

Diagnostic information

• Windows version from winver (e.g. Windows 11 Version 21H2, OS Build 22000.795)
  Windows Server 2019 Version 1809 (OS Build 17763.7792)

• Output of DiagReport
  DiagReport-20260110-032354.txt

• Installation logs
  install.log
  NPFInstall.log

• If installation failed, include SetupApi.dev.log
  setupapi.dev.log

• Any special hardware or software that may be relevant: VPN, firewall, antivirus, virtualization (SR-IOV passthrough, etc).
  VMware vSphere

Additional context
It is similar to #811, but the error is with NPFInstall.exe instead of Uninstall.exe

[fyodor]

Thanks @vitezslav-popovsky-solarwinds . We're investigating!

[dmiller-nmap]

The logs show that this was not a direct upgrade, but rather a new installation after an uninstall. It appears this process (install, uninstall) was run 164 times in 26 minutes (with a 12-minute break) before the failure happened, with a median time of 10 seconds between installs. The interval between the last uninstall and the failed install (3.7 seconds) is on the short side (bottom 10%), but not the shortest.

Does the problem also happen if you actually do an upgrade by invoking the installer without uninstalling first? You can add the /force option to ignore the existing installation's version number, since otherwise the installer will just exit immediately if the same version is already installed.

Most likely the underlying OS/filesystem behavior causing this is the same as the cause of #811, but the fix will be more complicated because NPFInstall.exe cannot be run from the temporary directory for some uses like installing the driver.

[vitezslav-popovsky-solarwinds]

@dmiller-nmap I am using the following script to test this:

Uninstall/Install 1.85/Install 1.86

# Helper to run a process and return its exit code
function Invoke-Exe {
    param(
        [Parameter(Mandatory)]
        [string]$FilePath,
        [string[]]$Arguments = @()
    )
    if (-not (Test-Path -LiteralPath $FilePath)) {
        Write-Error "Not found: $FilePath"
        return $null
    }
    $p = Start-Process -FilePath $FilePath -ArgumentList $Arguments -Wait -PassThru -NoNewWindow
    return $p.ExitCode
}

# --- Config (tweak as needed) ---
$UninstallerPath = "C:\Program Files\Npcap\Uninstall.exe"
$Installer185    = ".\npcap-1.85-oem.exe"
$Installer186    = ".\npcap-1.86-oem.exe"

$NpcapArgs = @(
    '/S',
    '/loopback_support=no',
    '/dlt_null=no',
    '/admin_only=yes',
    '/dot11_support=yes',
    '/winpcap_mode=no'
)

# Safety guard to avoid endless loops; set to $null to remove the limit
$MaxAttempts = $null

# --- Loop control ---
$attempt = 0
$code186 = $null

do {
    $attempt++
    Write-Host "========== Attempt #$attempt ==========" -ForegroundColor Cyan

    # 1) Uninstall
    $codeUninstall = Invoke-Exe -FilePath $UninstallerPath -Arguments '/S'
    Write-Host "Uninstall exit code: $codeUninstall"

    # 2) Install 1.85
    $code185 = Invoke-Exe -FilePath $Installer185 -Arguments $NpcapArgs
    Write-Host "1.85 install exit code: $code185"

    # 3) Install 1.86
    $code186 = Invoke-Exe -FilePath $Installer186 -Arguments $NpcapArgs
    Write-Host "1.86 install exit code: $code186"

    if ($MaxAttempts -and $attempt -ge $MaxAttempts) {
        Write-Warning "Reached MaxAttempts = $MaxAttempts; exiting the loop."
        break
    }

    # Optional pause between attempts
    Start-Sleep -Seconds 2

} while ($code186 -eq 0)

Write-Host "Done. Final 1.86 exit code: $code186"

And just now it gave me the result:

PS C:\opt> .\Repro-NpcapUpgrade.ps1
========== Attempt #1 ==========
Uninstall exit code: 0
1.85 install exit code: 0
1.86 install exit code: 2
Done. Final 1.86 exit code: 2
PS C:\opt>

[vitezslav-popovsky-solarwinds]

@dmiller-nmap I've updated the testing script to not use uninstall:

Install 1.85 force/Install 1.86

# Helper to run a process and return its exit code
function Invoke-Exe {
    param(
        [Parameter(Mandatory)]
        [string]$FilePath,
        [string[]]$Arguments = @()
    )
    if (-not (Test-Path -LiteralPath $FilePath)) {
        Write-Error "Not found: $FilePath"
        return $null
    }
    Write-Host "Starting: $FilePath $($Arguments -join ' ')"
    $p = Start-Process -FilePath $FilePath -ArgumentList $Arguments -Wait -PassThru -NoNewWindow
    return $p.ExitCode
}

# --- Config (tweak as needed) --
$Installer185    = ".\npcap-1.85-oem.exe"
$Installer186    = ".\npcap-1.86-oem.exe"

$NpcapArgs = @(
    '/S',
    '/loopback_support=no',
    '/dlt_null=no',
    '/admin_only=yes',
    '/dot11_support=yes',
    '/winpcap_mode=no'
)

# Safety guard to avoid endless loops; set to $null to remove the limit
$MaxAttempts = $null

# --- Loop control ---
$attempt = 0
$code186 = $null

do {
    $attempt++
    Write-Host "========== Attempt #$attempt ==========" -ForegroundColor Cyan

    # 1) Install 1.85
    $code185 = Invoke-Exe -FilePath $Installer185 -Arguments $($NpcapArgs + '/force')
    Write-Host "1.85 install exit code: $code185"

    # 2) Install 1.86
    $code186 = Invoke-Exe -FilePath $Installer186 -Arguments $NpcapArgs
    Write-Host "1.86 install exit code: $code186"

    if ($MaxAttempts -and $attempt -ge $MaxAttempts) {
        Write-Warning "Reached MaxAttempts = $MaxAttempts; exiting the loop."
        break
    }

    # Optional pause between attempts
    Start-Sleep -Seconds 2

} while ($code186 -eq 0)

Write-Host "Done. Final 1.86 exit code: $code186"

and I got the result:

========== Attempt #1 ==========
Starting: .\npcap-1.85-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /force
1.85 install exit code: 0
Starting: .\npcap-1.86-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no
1.86 install exit code: 0
========== Attempt #2 ==========
Starting: .\npcap-1.85-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /force
1.85 install exit code: 0
Starting: .\npcap-1.86-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no
1.86 install exit code: 0
========== Attempt #3 ==========
Starting: .\npcap-1.85-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /force
1.85 install exit code: 0
Starting: .\npcap-1.86-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no
1.86 install exit code: 0
========== Attempt #4 ==========
Starting: .\npcap-1.85-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /force
1.85 install exit code: 0
Starting: .\npcap-1.86-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no
1.86 install exit code: 0
========== Attempt #5 ==========
Starting: .\npcap-1.85-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /force
1.85 install exit code: 0
Starting: .\npcap-1.86-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no
1.86 install exit code: 0
========== Attempt #6 ==========
Starting: .\npcap-1.85-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /force
1.85 install exit code: 0
Starting: .\npcap-1.86-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no
1.86 install exit code: 0
========== Attempt #7 ==========
Starting: .\npcap-1.85-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /force
1.85 install exit code: 0
Starting: .\npcap-1.86-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no
1.86 install exit code: 2
Done. Final 1.86 exit code: 2

[dmiller-nmap]

@vitezslav-popovsky-solarwinds Does the issue still persist if you introduce a delay between installing 1.85 and installing 1.86? I realize that repeating the test many times is done in order to provoke issues that may not be apparent until the product is deployed at a larger scale, but since the issue itself appears to be a race condition, I want to be sure that the condition is not artificial. For instance, if the problem only happens when a file is created, deleted, and then created again in a short time, then it will not happen in any production system because any existing Npcap installation will be more than 2 seconds old when it is replaced.