HP Driver Install errors while using Optimized Image Guide

[Cragganmore]

Mod note: Moved to separate thread, per Hellbovine's request.

Hey everyone

I have now taken over your guide (Hellbovines "Optimized Image") and adapted it for myself. So far everything works fine, only one strange problem I still have. It seems that something with rights is not working properly:
- I have two HP laptops, one about 13 years old and one 2 years old.
- I have my custom image installed on both devices, which works without any problems
- I downloaded all the drivers for each laptop from HP.com and wanted to install them before I set foot on the internet for the first time
- This also works well on the old laptop.
- On the other hand, the new laptop, for which all drivers for Windows 11 are available (with the old one only for Windows 10), only very few drivers can be installed.
- HP drivers are usually SPxxxx.exe files. If you open it, a directory "C:\SWSetup" is created, where each driver gets an SPxxxx directory where its files are extracted.
- After unpacking, however, nothing happens anymore or a command prompt appears briefly, which soon disappears again, without a message. - In the log files, I saw the following: "Error Adding Driver Package: Access Denied"
- If I update the driver in the Device Manager for the devices without drivers and enter the folder C:\SWSetup to search for drivers, Windows "seems" to find the drivers and install them.
- When I try to open the folder C:\Windows\Temp in Explorer, I also get the message that I don't have permission to do so, whether I want to open it as an administrator, which then works without further ado.
- On my main computer, which I set up about 1 year ago with a custom Windows, I can open C:\Windows\Temp without any problems
- On the two HP laptops I create a user during the setup process, which is then (seems to be) the Local Admin
- I took the UAC settings from your guide.

What can be the reason for this problem? Somehow I'm the local admin, but I don't seem to have the necessary rights everywhere.

 

[Hellbovine]

...Somehow I'm the local admin, but I don't seem to have the necessary rights everywhere...

I don't think this is related to my guide, since I cannot think of any tweak that could do this. I also have an HP stream 11 laptop from 2022 that has no issues with the guide on W10. My work is not tested on W11 and in my FAQ I mention that I won't install W11 to troubleshoot issues, since it's a different OS, especially as each build diverges further from W10. If the fault is on my end though, I will fix it of course.

What I would do is take this W11 build version and install an unmodified image of that to see if the issue still exists, to rule out if Microsoft is at fault. Also, attach any other tweaks you're using, such as registry files that aren't mine, an XML preset you used, and post-setup stuff.

Let us know if you tried integrating drivers or only doing it on a live install. This issue could be even be related to the last few NTLite patches which have started causing problems for people, so rolling back the NTLite version and making a new image may work. Lastly, Garlin has many posts on things like HP drivers and their weird quirks, which could be the culprit too.

 

[garlin]

HP drivers installer might be installing the UWP-based HP Support Assistant (barf, gag).

Extract the SP* installer (or install it on a live system), and check the subfolders for any *.appxbundle file. If that's the case, you're better off extracting the drivers into standalone folders, and importing the drivers into your NTLite image.

The install process for Support Assistant is hideously broken with Post-Setup. First, UWP packages can be installed by a privileged, non-interactive user like SYSTEM, but UWP apps can only be run by a normal user. Next the HP installer gets bent out of shape, if you're already elevated when launching the installer (wtf?).

I think the HP OEM driver packs (if you find them) are friendly. They're crap free.

 

[Hellbovine]

I also support the notion that HP Support Assistant is garbage. It was forcibly installed on my laptop by Windows Update when I was testing things after I bought it, and every reboot would then throw an error message until I uninstalled that software.

Drivers are a big issue with laptops as a whole, because they tend to get many extra drivers and optional junk that equivalent desktop hardware doesn't. For example, the HP website says I need like 20 drivers, when the reality is only half or less are actually mandatory, the rest are usually adding more potential for bugs, resource usage, DPC latency, and telemetry, for little to no usefulness in return.

 

[Cragganmore]

Thank you two for your reply.

I have already tried to install an untouched original windows iso on the laptop. So it works "better", but not well either. The behavior of the drivers is the same without internet. It works "better" with the HP Assistant. But I think that the automatic driver update is ultimately the crucial thing that the drivers are installed.

But what do you think about the lack of rights to C:\windows\temp? This has nothing to do with the drivers.

 

[Cragganmore]

Thank you two for your reply.

I have already tried to install an untouched original windows iso on the laptop. So it works "better", but not well either. The behavior of the drivers is the same without internet. It works "better" with the HP Assistant. But I think that the automatic driver update is ultimately the crucial thing that the drivers are installed.

But what do you think about the lack of rights to C:\windows\temp? This has nothing to do with the drivers.

What I have improved to mention is that the "flush out all activity that is waiting silently in the background.bat" (rundll32.exe advapi32.dll,ProcessIdleTasks & pause) of Hellbovine on these two HP laptops where I have installed my custom Windows are not started by double-clicking. It's only when I run them "as an admin" that they start properly.

On my main computer, however, this works without "running as administrator".

I suspect that there is something wrong with permissions on my custom Windows.

 

[garlin]

Review your UAC settings.

 

[Hellbovine]

...But what do you think about the lack of rights to C:\windows\temp? This has nothing to do with the drivers.

I think you may need to slow down a bit, since it feels like you're skipping over pertinent tips. Here's what I suggested that you investigate, paraphrased in a list from my first reply. Report back with the results of these so we have data to analyze, otherwise we're all just guessing:

1) Attach extra registry files, XML presets, and post-setup information when asking for help.
2) Did you try integrating drivers with NTLite as a workaround?
3) Are you manually installing these drivers on a live install or through scripts?
4) The latest NTLite versions are buggy, rollback to December and make a new image.
5) Research Garlin's posts about HP drivers using this (link) Boolean search.
6) Please clarify if both drivers and permissions are good on W10, but not W11, correct?

...It's only when I run them "as an admin" that they start properly...

I do mention that in the paragraph you're quoting from. A lot of stuff nowadays requires running as admin to work properly, and I always do that when installing drivers/software, ever since Vista. Go ahead and try it on your HP drivers and see if they install, since that could be the culprit too.

 

[Cragganmore]

Thanks again for your response and sorry for my late reaction, i was out for some days.

1) Attach extra registry files, XML presets, and post-setup information when asking for help.

I do some more tests and then i will post these XML presets...

2) Did you try integrating drivers with NTLite as a workaround?

Yes, for the newer HP-Laptop i integrated the Intel Rapid Storage drivers, because else it won't see my drive during setup prozess. I had some troubles to do so, but another threat in this forum helped me.

3) Are you manually installing these drivers on a live install or through scripts?

No

4) The latest NTLite versions are buggy, rollback to December and make a new image.

Ok, i just update to the latest version... i try it later

5) Research Garlin's posts about HP drivers using this (link) Boolean search.

I do the research with the HP drivers later when i'm sure, that my windows image is runnig well. It seems only the newer HP-Laptop has these problems. By the way, could it be, that the intel rapid storage drivers cause these problems, because thats one drifference to the older HP Laptop?

6) Please clarify if both drivers and permissions are good on W10, but not W11, correct?

Sorry, i have no win10 here and never tested. Before i was on Win7

I do mention that in the paragraph you're quoting from. A lot of stuff nowadays requires running as admin to work properly, and I always do that when installing drivers/software, ever since Vista. Go ahead and try it on your HP drivers and see if they install, since that could be the culprit too.

Hm, do you have a link where the right management of windows is well explained? I've been wondering for a long time what the difference is between "local admin" and "run as administartor" or the standard hidden "admin" on windows installation and how they act. I would also be interested in how exactly UAC works. On my prevoius Win7 install i never use "run as administartor" an i never hat problems.

Review your UAC settings.

How can i review them the best way? Check in the registry?

 

[garlin]

To modify your UAC settings, you would have changed something in NTLite's Settings / UAC, or imported reg file updates.

Ironically there's a class of apps that expects to invoke UAC elevation, and don't run correctly when you're already elevated. This is related to "filtering" the security token that gets created to grant a running process admin rights.

The only functional difference btw running as built-in Administrator vs a member of Admin group is the Administrator (by default) is always elevated and never gets checked for UAC. For convenience, some Admin users like changing UAC so they don't get nagged. When that happens, those broken apps get confused because they're expecting UAC and it doesn't.

HP Support Assistant installer falls into that category.

 

[Cragganmore]

To modify your UAC settings, you would have changed something in NTLite's Settings / UAC, or imported reg file updates.

Ironically there's a class of apps that expects to invoke UAC elevation, and don't run correctly when you're already elevated. This is related to "filtering" the security token that gets created to grant a running process admin rights.

The only functional difference btw running as built-in Administrator vs a member of Admin group is the Administrator (by default) is always elevated and never gets checked for UAC. For convenience, some Admin users like changing UAC so they don't get nagged. When that happens, those broken apps get confused because they're expecting UAC and it doesn't.

HP Support Assistant installer falls into that category.

Wow, that's exactly what I wanted to hear! Somehow something doesn't seem to work as it should and you explained to me what it is.
I did the following tests to find out why sometimes I have enough rights and sometimes I don't. I proceeded as follows:

1. I tested different windows images and created my admin user in different ways to see if I had "enough" rights with it or not.
2. As a test if I have enough rights, I checked the direct access to "c:\windows\temp" via explorer (whether it worked "run as administrator" or without) and on the other hand I ran Hellbovine's "flush out all activity that is waiting silently in the background.bat" (rundll32.exe advapi32.dll,ProcessIdleTasks & pause) in explorer and also checked if it works without "run as administrator".
3. It didn't matter if I used a untouched original windows 11 23H2 (without updates), Hellbovine's Guide for an optimized image or the image with my own customizations, I had too few rights in any case.
4. What mattered, however, was the way I created my admin:
- Create admin-user during the installation process --> not enough rights
- Create admin-user during the burning process using Rufus --> not enough rights
- Create admin-user already in NTLite (Configurate -> Unattanded "enable" -> Add local Account -> "Enable buil-in Administartor using this account" --> enough rights
I think that's the reason for the lack of rights. I initially had problems to create an account directly during the installation and tried various things. Therefore, I couldn't understand why later the HP drivers worked once and then not again.

Now my question: Which is the better way? To use the build in admin or to create a new admin and then always click "run as administrator"? Probably the latter, isn't it?

 

[Cragganmore]

I have one more question, maybe this should be moved to a separate thread.

I'm still struggling when it comes to power plans.

I have taken the power plan adjustments from Hellbovines Guide: Optimized Image and adjusted them slightly for myself. So I would like to use the three standard power plans Power Saver, Balanced and High performance.
When I install Windows 11 now (and I don't know if this is a pure Win11 problem) I never see all three Power plans. Neither in the old control panel -> Power options nor in the new Settings -> power & battery. Only in the Mobilie Center can all three be found.

Actually, I wanted to use the app power switcher to change the power modes, but it never shows all modes. Also the PowerSettingsExplorer, which i use to check the plan settings, never shows all modes.

It is so:
- If the set mode is Balanced, then the other two are hidden
- If I set one of the other two, then the plus balanced one is displayed.

I've found out that the following commands in cmd help to always display all three modes:
High Performance:

powercfg -duplicatescheme 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c

Balanced:

powercfg -duplicatescheme 381b4222-f694-41f0-9685-ff5bb260df2e

Power saver:

powercfg -duplicatescheme a1841308-3541-4fab-bc81-f71556f20b4a

My question now is, are these three commands safe to use? I've read a lot about S0, S1, S2, S3 standby mode, but never really understood what it's all about. Sometimes it says that you shouldn't use S3 (this three power plans) if the system supports S0, then it says that S0 is sometimes faulty.

 

[Hellbovine]

4. What mattered, however, was the way I created my admin:

Those admin issues seem to me like either NTLite or the unattended file is creating an account with TrustedInstaller permissions, and those permissions continue to stick around after a user is created. If so, this warrants investigation as a bug.

 

[Cragganmore]

Those admin issues seem to me like either NTLite or the unattended file is creating an account with TrustedInstaller permissions, and those permissions continue to stick around after a user is created. If so, this warrants investigation as a bug.

Hey Hellbovine
But also if i use a clean untouched Win11 Iso and create a user while setup process, i have this issue with some HP-Drivers. You mean a "bug" on HP-Drivers?

And what do you mean by saying:

4) The latest NTLite versions are buggy, rollback to December and make a new image.

What bugs do NTLite have since then? Where they not solved on the newest updates?

 

[Hellbovine]

When I install Windows 11 now (and I don't know if this is a pure Win11 problem) I never see all three Power plans...

This is intentional and a bigger problem on W11. Microsoft started changing power behavior over the last few years, pushing to consolidate things into a mobile-friendly option, where a user would move the power plan slider bar upwards to set higher performance or move it down for power savings, rather than customizing individual plans. The presumable goal is to be more granular in the future, by having more power bar slider stepping stones.

The disappearing power plans is purely cosmetic though, they can all still be enabled, it will just only show the name of whichever plan is currently active, plus the Balanced plan, because that goes back to Microsoft reconfiguring things slowly over time and using that plan as the base.

powercfg -duplicatescheme GUID

This is a working, but incorrect way to enable power plans. The "duplicatescheme" clones an existing power plan and the "GUID" numbers are manually chosen by a user as a reference label. Instead, use powercfg /setactive or registry keys (link) to set plans using the intended approach.

My question now is, are these three commands safe to use? I've read a lot about S0, S1, S2, S3 standby mode, but never really understood what it's all about. Sometimes it says that you shouldn't use S3 (this three power plans) if the system supports S0, then it says that S0 is sometimes faulty.

The thing that matters for the masses, is that the three built-in plans know how to adjust themselves according to the power capabilities of each machine, so a user doesn't need to worry about these issues except in niche cases, usually due to a BIOS or driver bug, legacy hardware, or operator-error.

 

[garlin]

No user account has TrustedInstaller privileges, that's by design. The security model is that TI-level tasks requested by WU are delegated to the TrustedInstaller service for actual execution.

There is no functional difference btw built-in Administrator and any member of Administrators group, EXCEPT for the default UAC policy as applied to Administrator. If you change the policy, then UAC works the same for the Administrator user.

 

[Cragganmore]

This is a working, but incorrect way to enable power plans. The "duplicatescheme" clones an existing power plan and the "GUID" numbers are manually chosen by a user as a reference label. Instead, use powercfg /setactive or registry keys (link) to set plans using the intended approach.

So there's no more comfortable way than to make three batch files, each of which sets the powerplan?

 

[Cragganmore]

To modify your UAC settings, you would have changed something in NTLite's Settings / UAC, or imported reg file updates.

Ironically there's a class of apps that expects to invoke UAC elevation, and don't run correctly when you're already elevated. This is related to "filtering" the security token that gets created to grant a running process admin rights.

The only functional difference btw running as built-in Administrator vs a member of Admin group is the Administrator (by default) is always elevated and never gets checked for UAC. For convenience, some Admin users like changing UAC so they don't get nagged. When that happens, those broken apps get confused because they're expecting UAC and it doesn't.

HP Support Assistant installer falls into that category.

Garlin, I was still testing to see if I could get the HP drivers to work "normally" in some way.
The best option was to run the SPxxxx.exe files as admin. In this way, only the file to C:\SWSetup\SPxxxx will be unzipped, but no further execution will be executed. I then have to run the "installdrv.cmd" again in this folder as admin as well, so the drivers are installed (without gui). The file "HPMUP.exe", which would probably be responsible for executing the driver installer, does not work at all.
From this point of view, these problems are probably really due to the HP driver package. No matter what I set with UAC, it still doesn't work (even with untouched win11 iso)

 

[Hellbovine]

...if i use a clean untouched Win11 Iso and create a user while setup process, i have this issue with some HP-Drivers...

I'm going off what you wrote in the #4 list, where you said if you specifically use the NTLite tool to make an unattend file, that admin is getting some kind of special setting added to it, automatically launching everything as if you manually chose the "run as admin" option.

Based on Garlin's response though, it sounds like we also need to see all the other tweaks and such you've done, since there may be more at play. Right now, my thinking based purely on the data presented, is that one could take a completely default ISO and do 3 different installs like Cragganmore did, and only the NTLite/Unattend combo will result in a user that automatically runs everything as an admin without the need to right-click. Rufus uses an unattend file as well, so why is it not experiencing the same result as having NTLite generate a user, and that's where my mind is.

What bugs do NTLite have since then? Where they not solved on the newest updates?

There's many new bug threads coming into the forum ever since the big update (link) on March 12th, so reverting back to a version from last year may fix issues people are having. Anyone using post-setup seem to be the ones affected by the current NTLite bugs. Nuhi is really dedicated though, so I can't imagine these bugs will still be here by the summer, but I don't think they'll be fully fleshed out until then either, since a major refactor like this is likely to cause other issues that won't rear their head until some of the surface bugs are fixed.

 

[Cragganmore]

I'm going off what you wrote in the #4 list, where you said if you specifically use the NTLite tool to make an unattend file, that admin is getting some kind of special setting added to it, automatically launching everything as if you manually chose the "run as admin" option.

Based on Garlin's response though, it sounds like we also need to see all the other tweaks and such you've done, since there may be more at play. Right now, my thinking based purely on the data presented, is that one could take a completely default ISO and do 3 different installs like Cragganmore did, and only the NTLite/Unattend combo will result in a user that automatically runs everything as an admin without the need to right-click. Rufus uses an unattend file as well, so why is it not experiencing the same result as having NTLite generate a user, and that's where my mind is.

I guess NTlite uses the "built in admin" and make it somehow "visible" in contrast to the other methods, which creates normal users in admin-group.

There's many new bug threads coming into the forum ever since the big update (link) on March 12th, so reverting back to a version from last year may fix issues people are having. Anyone using post-setup seem to be the ones affected by the current NTLite bugs. Nuhi is really dedicated though, so I can't imagine these bugs will still be here by the summer, but I don't think they'll be fully fleshed out until then either, since a major refactor like this is likely to cause other issues that won't rear their head until some of the surface bugs are fixed.

In NTlite i only use:

• add windows updates
• added the intel rapid storage driver
• use your "DefaultLayouts.xml" and "LayoutModification.xml"
• importing REG files
• make setting changes
• remove some few components
• and use the unattanded function

So no post-setup, so i don't are affected by these NTLite bugs?