NPcap 1.80 Silent Install Failure on Legacy Windows Versions

1/23/2026 11:42 PM

1/26/2026 4:33 PM

The issue is caused by a known NPcap issue affecting versions 1.50 and later. It is resolved in NPcap 1.81 OEM when installed with the /prior_driver option.

 

Affected environment

• Operating systems:

  • Windows Server 2008 R2

  • Windows 7

  • Windows 8.1

  • Windows Server 2012 R2

• Components/features that rely on NPcap:

  • DPI plugin

  • NetPath plugin

  • ADM plugin

• NPcap versions:

  • Affected: NPcap 1.50–1.80

  • Fixed: NPcap 1.81 OEM and later (with /prior_driver)

Note: Windows Server 2008 R2 and Windows 7 have been end-of-life by Microsoft for several years, so upgrading the operating system is strongly recommended wherever possible.

---

Symptoms

When the agent tries to install the NPcap 1.80 plugin (e.g., npcap_1.80.apkg) on an affected system, you may observe:

• The NPcap installer (npcap-1.80-oem.exe) is called with a silent command line such as:

  npcap-1.80-oem.exe /S /npf_startup=yes /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /vlan_support=yes /winpcap_mode=no
  

• Despite /S, a driver install warning/prompt appears on the desktop.

• The plugin installation fails with warnings similar to the following in the logs:

  [WARN] ewPluginManager::installer::runExePackageInternal - GetExitCodeProcess() indicates process exit code was (2) for [NPcap 1.80], PID [2976]
  [WARN] ewPluginManager::installer::runExePackageInternal - completed with process exit code [0x2] for [NPcap 1.80]
  [WARN] ewPluginManager::PluginDeploymentEngine::handleInstallResults - called with code [2]
  [WARN] ewPluginManager::PluginDeploymentEngine::handleInstallResults - indicates the plugin installation failed for: NPcap 1.80; reason: Installation of 'NPcap 1.80' failed.
  

• In some cases, you may also see:

  The system cannot find the file specified.
  Code [0x2].
  

As a result, DPI/NetPath/ADM features that depend on NPcap will not be available on that agent until the driver is successfully installed.

 

NPcap has been updated in newer versions of the SolarWinds Platform to address this issue, as noted below:

• 2026.1 – NPcap 1.85
• 2025.4.3 – NPcap 1.85
• 2025.4 – NPcap 1.81
• 2025.2 – NPcap 1.80 

Orion Platform

The issue is due to a driver installation prompt/behavior change introduced in NPcap starting with version 1.50. The NPcap team tracks this under an upstream issue:

• NPcap bug affecting all versions since 1.50 (see NPcap GitHub issue link referenced internally).

Because of this bug, the NPcap 1.80 OEM installer does not behave fully silently on pre–Windows 10 systems, which breaks automated/silent plugin deployments on those OS versions.

1. Preferred: Use NPcap 1.81 or later on affected systems

NPcap 1.81 OEM introduces a fix for the /prior_driver option on Windows 7, 8, and 8.1 (and also addresses similar issues on some Windows Server 2012 R2 systems).

From the NPcap changelog:

“Fixed an issue with the installer where the appropriate code-signing certificates for the /prior_driver=yes option were not installed on Windows 7, 8, and 8.1. This could lead to failed installations on those versions of Windows.”

When NPcap 1.81 OEM is installed with /prior_driver=yes, it successfully installs driver version 5.1.30.408 on Windows 7, 8.1, Windows Server 2008 R2, and Windows Server 2012 R2.

Example successful command line on these systems:

npcap-1.81-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /prior_driver=yes

After running this, checking the installed driver shows:

wmic datafile where name='c:\\windows\\system32\\drivers\\npcap.sys' get version

Version
5.1.30.408

Once NPcap 1.81 (or later) is installed manually or via an updated plugin that uses this command line, the plugin installation succeeds on:

• Windows 7

• Windows 8.1

• Windows Server 2008 R2

• Windows Server 2012 R2

Action: Ensure your deployment uses NPcap 1.81 OEM or later with the /prior_driver=yes option on these legacy Windows versions.

---

2. Workaround for environments still using NPcap 1.80

If you are temporarily constrained to NPcap 1.80 on Windows Server 2008 R2, a partial workaround was identified using the /prior_driver option on this OS:

npcap-1.80-oem.exe /S /npf_startup=yes /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /vlan_support=yes /winpcap_mode=no /prior_driver

On a Windows Server 2008 R2 system, this approach installed the legacy driver version 5.1.30.408 successfully.

However:

• This does not work reliably on Windows 7; the NPcap team fixed that only in 1.81.

• Similar issues can occur on Windows 8.1 and some Windows Server 2012 R2 systems with 1.80.

Recommendation: Treat this as a temporary workaround only for Windows Server 2008 R2. Plan to move to NPcap 1.81 or later as soon as possible.

---

Manual installation steps (for failed plugin installs)

If the NPcap plugin installation fails on an affected agent:

1. Confirm OS and NPcap version

   • Check that the system is Windows 7, 8.1, Server 2008 R2, or Server 2012 R2.

   • Review plugin/agent logs for NPcap 1.80 silent install failures with exit code 2.

2. Obtain the appropriate NPcap installer

   • Use the NPcap 1.81 OEM installer (or later) provided with your product build or per SolarWinds guidance.

3. Run NPcap installer with /prior_driver=yes (recommended)

   • Open an elevated command prompt.

   • Run a command similar to:

     npcap-1.81-oem.exe /S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no /prior_driver=yes
     

   • Adjust command-line switches as required by your environment or product documentation.

4. Verify NPcap driver version

   • From an elevated command prompt:

     wmic datafile where name='c:\\windows\\system32\\drivers\\npcap.sys' get version
     

   • Confirm the version is 5.1.30.408 (or later, depending on the NPcap version you deploy).

5. Retry the plugin installation

   • Re-deploy or re-enable the DPI/NetPath/ADM plugin that depends on NPcap.

   • Confirm that the plugin now installs successfully on the agent.

---

Additional considerations

• Limited impact: NPcap is used only by DPI, NetPath, and ADM plugins, which are not enabled in every environment and require explicit installation.

• Security posture: Shipping and maintaining older NPcap binaries for a small subset of legacy Windows systems increases exposure to vulnerabilities in those older drivers. Whenever possible:

  • Prefer NPcap 1.81+ over older NPcap versions.

  • Plan to phase out unsupported OS versions (Windows 7, Windows Server 2008 R2).

• Product updates: Internal testing has verified that using the updated NPcap installer/parameters allows the NPcap-based plugin to install successfully on all of the following OS versions: Windows 7, Windows 8.1, Windows Server 2008 R2, and Windows Server 2012 R2.