Sticky Windows 11 and Legacy USB Drivers for HEX-USB+CAN and Older Interfaces

[Andy]

UPDATE: Possible new work-around HERE <- Click the link

---

A brief timeline:

13 billion years BC Big Bang happens
66 million years BC Dinosaur Extinction
1776-07-04 Second Continental Congress ratifies the Declaration of Independence
1903-12-17 Wright Brothers make first successful, powered, controlled flight
1969-07-20 Neil Armstrong walks on the moon
2000-05-16 Ross-Tech publishes the first version of VAG-COM and ISO-COM interfaces.
2003-02-15 TWIN-USB is our first USB interface and uses RT USB drivers
2004-06-01 HEX-USB+CAN is released with RT USB drivers
2009-10-22 Windows 7 released
2012-10-30 Windows 8 released
2014-02-13 HEX-NET is released using native HID drivers in Windows
2015-07-29 Windows 10 released
2016-01-12 Windows 8 extended end date
2016-12-31 HEX-USB+CAN is discontinued
2017-01-01 HEX-V2 is released using native HID drivers in Windows
2019-01-01 2019 and newer cars require a HEX-NET or HEX-V2
2021-10-05 Windows 11 released
2023-02-08 Windows 7 extended end date
2025-10-14 Windows 10 retirement date
2026-04-14 Windows 11 update KB5083769 breaks legacy USB driver function
---You are here---
2063-04-05 Dr. Zefram Cochrane invents the first successful warp drive engine

If you are using Windows 11, you should be using one of our current HEX-NET or HEX-V2 interfaces that use the native HID drivers that come with Windows. This has the added benefit of also supporting 2019 and newer cars that our older legacy interfaces do not.

It's been almost a decade since the older legacy interfaces went out of production and Windows finally broke this.

If anyone finds a workaround they have actually tested with success, please let us know because we're all ears. Otherwise we recommend legacy interface users stick with a PC using an older OS or take advantage of our trade-in program to get a HEX-V2 or HEX-NET.

 

[TTT]

In the link you provided, there are steps given to disable the enforcement. Cannot test, since don't have old interface.

 

[Uwe]

In the link you provided, there are steps given to disable the enforcement. Cannot test, since don't have old interface.

True, but how likely is the typical user is to be willing do this?

Step 1: Disable Secure Boot           

Restart your computer and enter the  UEFI firmware settings menu  (BIOS). You can typically do this by pressing a key during boot (such as  F2  ,  F10  ,  Del  , or  Esc  — check your device manufacturer's documentation)

Alternatively, in Windows: go to  Settings  >  System  >  Recovery  >  Advanced startup  >  Restart now  . Then choose  Troubleshoot  >  Advanced options  >  UEFI Firmware Settings  >  Restart  .

In your firmware settings, locate the  Secure Boot  option (usually under the  Security  or  Boot  tab).
Set Secure Boot to  Disabled  .
Save changes and exit the firmware settings.
            
Step 2: Delete the policy files from the EFI System Partition
            
1.   Open  PowerShell as an administrator  .
        
2.   Mount the EFI System Partition by running:
            
mountvol S: /s
            
You can use any available drive letter in place of `S:`.
            
3.   Delete the audit policy file:
            
del S:\EFI\Microsoft\Boot\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip
            
4.    If the enforcement policy is also present, delete it:
            
del S:\EFI\Microsoft\Boot\CiPolicies\Active\{8F9CB695-5D48-48D6-A329-7202B44607E3}.cip
            
5.   Also check for and delete the policies from the Windows system directory:
            
del %windir%\System32\CodeIntegrity\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip
            
del %windir%\System32\CodeIntegrity\CiPolicies\Active\{8F9CB695-5D48-48D6-A329-7202B44607E3}.cip
            
6.    Unmount the EFI partition:
            
mountvol S: /d
            
Step 3: Restart your computer
            
Restart your device for the changes to take effect. After restart, the policy will no longer be active and all signed drivers — including those without WHCP certification — will be allowed to load.
            
Step 4: Re-enable Secure Boot
            
After removing the policy files, re-enable Secure Boot in your UEFI firmware settings to maintain other Secure Boot protections.

We had plenty of resistance from users about turning off Memory Integrity, and that's just simple Settings.

-Uwe-

 

[Zenerdiode]

True, but how likely is the typical user is to be willing do this?

Not just the typical user, but also the corporate user. I’m very lucky that my company allows known (signed?) executables to run on their devices. It allows me to have a HEX-NET in my laptop bag in case any of my friends or colleagues want some VCDS work and saves me from having to carry another device.

My IT department would not allow me to disable any policies like that. In fact, even though I’m supposed to have admin rights on my laptop, the good ole Domain Group Policy overrides a lot of what I try to do. I’m not thick, but I can’t get a HN to connect to VCDS over wi-fi. Must be blocking a port or two. Heck, we even have to apply with a ‘strong business case’ to have USB ports enabled.

 

[Adam]

I doubt everything began at the Big Bang... but thank you for the heads up on the USB drivers and Win11 thing Andy!

 

[TTT]

No pain, no gain.

 

[golfi_vend]

Do I get right that the issue is with FTDI driver?

Havent looked but FTDI drivers themselves are good? - Im using kcan cheap cable for some my own developmentand up until now I havent seen issues.

 

[Uwe]

Havent looked but FTDI drivers themselves are good?

Yes, unmodified FTDI drivers are OK. FTDI gets them WHQL certfied. Problem is that our old interfaces used a different block of PIDs that was assigned to us by FTDI, and if you change the PIDs for the driver, the certification is not valid. In the past this was no problem, since we could sign the modified driver with our regular Code Signing Certificate, and Windows was happy with that. Now Windows 11 is demanding not just a signed driver, but a WHQL certified driver, and the process to get that done is not something we are willing to undertake for legacy products that were introduced more than 20 years ago and that we haven't sold in almost 10 years.

-Uwe-

 

[Andy]

We've had at least one report of success from a customer who did step 7 here:

Windows startup settings | Microsoft Support

Learn how to change Windows startup settings, including enabling Safe Mode.

support.microsoft.com

If that link doesn't work in your region, try doing a web search for "disable driver signature enforcement".

Keep in mind this disables driver signature enforcement for ALL drivers not just for the Ross-Tech one and also it's not persistent if you reboot.

If you are in a bind and give it a shot, let us know if it works and if not, blame Microsoft ... again.

Edit: Microsoft "helpfully" 404'ed the above page, so here are the plain-text steps:

Press “Windows key + I” to open Settings.
Go to the “Windows Update” > “Advanced options” page.
Click the “Recovery” option.
Click the “Restart now” button next to “Advanced startup“.
Go to the “Troubleshoot” > “Advanced Options” page in the advanced startup screen.
Click the “See more recovery options” option.
Click the “Start-up settings” option.
Click the “Restart” button.
Press “7” on your keyboard.
Windows will automatically reboot in the driver signature enforcement feature disabled state.
You can now install drivers that do not have a valid digital signature.
Once done, restart your system normally, and driver signature enforcement is enabled automatically.

 

[friech]

We've had at least one report of success from a customer who did step 7 here:

Windows startup settings | Microsoft Support

Learn how to change Windows startup settings, including enabling Safe Mode.

support.microsoft.com

If that link doesn't work in your region, try doing a web search for "disable driver signature enforcement".

Keep in mind this disables driver signature enforcement for ALL drivers not just for the Ross-Tech one and also it's not persistent if you reboot.

If you are in a bind and give it a shot, let us know if it works and if not, blame Microsoft ... again.

I can attest that this indeed works. I have the older Hex-Can interface. Just reboot after finishing your work with the interface to re-enable driver security on your Win11 device.

 

[Greyera]

We've had at least one report of success from a customer who did step 7 here:

Windows startup settings | Microsoft Support

Learn how to change Windows startup settings, including enabling Safe Mode.

support.microsoft.com

If you are in a bind and give it a shot, let us know if it works and if not, blame Microsoft ... again.

You have an astonishingly good idea there, doctor! As per above, I can confirm this is the route to make your legacy interface work again.

I did re-install VCDS 26.3.0 after disabling enforcement of driver certification in recovery mode and before making a successful attempt to let VCDS communicate with the ECU in a 2017 Skoda Superb.

Other options (such as disabling Memory integrity) didn't solve the issue earlier. Thanks guys!

 

[audi diyer]

I can attest that this indeed works. I have the older Hex-Can interface. Just reboot after finishing your work with the interface to re-enable driver security on your Win11 device.

Do you have to do this every time you want to use vcds? Or just when you install it?

 

[Red Quattro]

True, but how likely is the typical user is to be willing do this?

Step 1: Disable Secure Boot         

Restart your computer and enter the  UEFI firmware settings menu  (BIOS). You can typically do this by pressing a key during boot (such as  F2  ,  F10  ,  Del  , or  Esc  — check your device manufacturer's documentation)

Alternatively, in Windows: go to  Settings  >  System  >  Recovery  >  Advanced startup  >  Restart now  . Then choose  Troubleshoot  >  Advanced options  >  UEFI Firmware Settings  >  Restart  .

In your firmware settings, locate the  Secure Boot  option (usually under the  Security  or  Boot  tab).
Set Secure Boot to  Disabled  .
Save changes and exit the firmware settings.
          
Step 2: Delete the policy files from the EFI System Partition
          
1.   Open  PowerShell as an administrator  .
      
2.   Mount the EFI System Partition by running:
          
mountvol S: /s
          
You can use any available drive letter in place of `S:`.
          
3.   Delete the audit policy file:
          
del S:\EFI\Microsoft\Boot\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip
          
4.    If the enforcement policy is also present, delete it:
          
del S:\EFI\Microsoft\Boot\CiPolicies\Active\{8F9CB695-5D48-48D6-A329-7202B44607E3}.cip
          
5.   Also check for and delete the policies from the Windows system directory:
          
del %windir%\System32\CodeIntegrity\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip
          
del %windir%\System32\CodeIntegrity\CiPolicies\Active\{8F9CB695-5D48-48D6-A329-7202B44607E3}.cip
          
6.    Unmount the EFI partition:
          
mountvol S: /d
          
Step 3: Restart your computer
          
Restart your device for the changes to take effect. After restart, the policy will no longer be active and all signed drivers — including those without WHCP certification — will be allowed to load.
          
Step 4: Re-enable Secure Boot
          
After removing the policy files, re-enable Secure Boot in your UEFI firmware settings to maintain other Secure Boot protections.

We had plenty of resistance from users about turning off Memory Integrity, and that's just simple Settings.

-Uwe-

Hi Uwe & All,
Thanks for the advice on this post to try to help get my HEX+CAN Ross Tech licensed interface working with my Windows 11 machine...
I have repeatedly tried following the above steps 1 to 4 and reloaded the current version of VCDS including the drivers for legacy interfaces.

However the device manager status shows the same issue reporting
"Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)

An Application Control policy has blocked this file."

> Any further advice or work around steps to follow?

my HEX+CAN interface has been a trusted tool for years and I really want to get it back working!!

 

[Uwe]

my HEX+CAN interface has been a trusted tool for years and I really want to get it back working!!

See post #9.

-Uwe-

 

[Red Quattro]

See post #9.

-Uwe-

Thanks Uwe,
Much appreciated.
Ah! That made the difference. HEX+CAN interface now on Windows 11.
I did not appreciate it needs all the other steps listed above / as referred to by Microsoft's instructions ... as well as Recovery Mode Start Up Step 7 F7 which MS did not list.
In all a pretty long winded work around but got there in the end.

 

[r32hoo]

Post #9 worked for my Micro-CAN interface. I had to find my Microsoft Bitlocker key for my Lenovo laptop to disable driver signature verification, but I did find it eventually from Microsoft. Still, it might be time to upgrade from Micro-CAN to HEX-V2 with your trade-in program. That's a pretty good deal. Thanks for this post and information contained here.

 

[starguywisc]

Another PITA from Microsoft.

 

[Eric]

Another PITA from Microsoft.

You may not be ready to upgrade to a current-gen interface, but if you ever are, those and VCDS work pretty well with Wine under Linux at this point:

Debian Linux Success

Just a FYI. The software and hardware works on Debian Linux using wine. You must use it on wireless mode.

forums.ross-tech.com

 

[wh17]

Keep in mind this disables driver signature enforcement for ALL drivers not just for the Ross-Tech one and also it's not persistent if you reboot.

If you are in a bind and give it a shot, let us know if it works and if not, blame Microsoft ... again.

I would not do this on a production pc with other data. Yes this is a workaround but will also open doors..

If i check my time + cost i would buy an old laptop with windows10 which are available very cheap (around 50-70 Euro here in Europe), install VCDS and that´s it.

VCDS does need a high end laptop i think most of the old thrown away windows 10 systems will work.

Cost: 50-60 Euro + 10min time (install VCDS and test it)

As Windows10 gets no updates :-) you need not fear that a future Windows 10 Release will require signed drivers....

If you trade-in to the latest hex-net you get 200$ for the old interface - not bad for a very old legacy system. Normally trade-in deals last for 3-4 years :-)

Another idea is to use am VM with Windows 10 on your Windows 11 PC or MacOS :-)

 

[Uwe]

If i check my time + cost i would buy an old laptop with windows10 which are available very cheap (around 50-70 Euro here in Europe), install VCDS and that´s it

That sounds like a good plan.

VCDS does not need a high end laptop i think most of the old thrown away windows 10 systems will work.

Fixed that for you.

Another idea is to use am VM with Windows 10 on your Windows 11 PC or MacOS :-)

I don't think that will work because the host OS needs to recognize the interface before it can pass data to the VM.

How about making a small partition on the Windows 11 PC and installing Windows 10 on that partition, then dual-boot?

-Uwe-