AnyConnect not working after Win10 update to 1709

[Waylander]

Hi Community,

looking for help with Anyconnect Secure Mobility Client 4.5.04029.

On my work laptop, IT forced deploy of Win10 update 1709.

The update script removed and reinstalled Anyconnect. 

After the update, NAM service won't start. Manual start shows error 1067, not so meaningful to troubleshoot the issue.

Tried reinstalling several times to no avail.

Any help would be greatly appreciated

[stsargen]

Please look in the setupapi.dev.log file located in the C:\Windows\INF\ directory for and Error 1460 timeout.  If you find this in the logs you are most likely hitting CSCvb59209.  Cisco TAC will be able to provide you with a Microsoft tool (PurgeNotifyObjects.exe) to correct this issue.  Once the issue is repaired you should only install AnyConnect 4.5.05xxx and not the 4.5.04xxx client.

Thanks,

Steve S.

[Waylander]

Hi Steve,

setupapi.dev.log actually contains some 1460 error. However, I believe the latest install is clean as the errors apparently are related to older attempts.

Can you, please, have a look and confirm this is CSCvb59209?

Dartbundle attached

Thank you in advance

[stsargen]

From the DART I can see that you are hitting https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd73562 at a minimum.  NAM is bound to the VA adapter, but this should not cause the service to fail to start.

Adapter name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
  Adapter ID: vpnva
  Driver Vendor : <Cisco Systems>
  Driver Date   : <1-4-2018>
  Driver Version: <4.5.4025.0>
  Bind Name: {28C689D6-8CC1-4E95-9895-D770E1FA5681}
  Status: 0
  Characteristics:
    Emulates a physical network card.
  Upper bindings:
    File and Printer Sharing for Microsoft Networks (Enabled)
    Cisco AnyConnect Network Access Manager Filter Driver (Enabled)

In order to correct this you will need to unbind the NAM filter from the VPN adapter. The bug above lists the command you need to run to accomplish this.

It looks like the NAM driver is installed, but the NAM agent cannot see it.  This "-13" Error means the NAM driver is missing.

28: ITTGTORMEGL3C: ott 05 2018 18:47:10.030 -0100: %NAM-3-ERROR_MSG: %[tid=15264]: Internal error 4, contact software manufacturer
29: ITTGTORMEGL3C: ott 05 2018 18:47:10.030 -0100: %NAM-7-DEBUG_MSG: %[tid=15264]: CssException for function 'acNetInit()' => -13{error} [CssManagerImpl_init.cpp:145]

[Waylander]

Unbound NAM filter from VPN adapter:

PS C:\WINDOWS\system32> Get-NetAdapterBinding -InterfaceDescription Cisco*

Name DisplayName ComponentID Enabled
---- ----------- ----------- -------
Ethernet 3 Internet Protocol Version 4 (TCP/IPv4) ms_tcpip True
Ethernet 3 Link-Layer Topology Discovery Mapper I/O Driver ms_lltdio True
Ethernet 3 Microsoft Network Adapter Multiplexor Protocol ms_implat False
Ethernet 3 File and Printer Sharing for Microsoft Networks ms_server True
Ethernet 3 Client for Microsoft Networks ms_msclient True
Ethernet 3 Microsoft LLDP Protocol Driver ms_lldp True
Ethernet 3 Internet Protocol Version 6 (TCP/IPv6) ms_tcpip6 True
Ethernet 3 Link-Layer Topology Discovery Responder ms_rspndr True
Ethernet 3 Cisco AnyConnect Network Access Manager Filter ... CSCO_acnamfd False
Ethernet 3 QoS Packet Scheduler ms_pacer True

no changes in NAM behavior, still fails to start.

Currently checking if I can install Msft KB4058258 as required by CSCvd73562. Not sure I can do this as windows update on my laptop is controlled by a corp group policy. will keep u posted.

As per NAM agent unable to "see" NAM driver, any ideas? 

[stsargen]

Could you provide a new DART bundle after clearing event viewer logs and rebooting th ePC.  Also please enable Extended logging.

Extended logging

1.  Open the AnyConnect UI and make sure it has focus

2. press <alt><shift><l>

3. right click on the AnyConnect tray icon and check the "Extended Logging" option

[stevenbahnsen1]

What does the script actually do? We ran this and it resolved our problem, but it seems like Cisco don’t know what it does. Has anyone found out internally from Microsoft what it does?

All I can tell from a high level is that it removes notify objects...

[Marius Gunnerud]

Did you restart your PC after uninstalling AnyConnect?

1. uninstall AnyConnect

2. reboot PC

3. install AnyConnect

[Waylander]

Hi Marius,

Yes, I did several times, even deleting C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client after uninstall.

[Marius Gunnerud]

Have a look at the following link.  Seems to be the same issue you are having.  Hope it helps.

https://community.cisco.com/t5/vpn-and-anyconnect/windows-10-update-to-build-1709-and-anyconnect-nam-wireless/td-p/3328483