signature=e4cff0f430886b33837393b991f501d2,Driver install semi fails with 800f024b

Server:

Windows 2008 R2 SP1 + current windows updates.

Xerox GPD PS 5.303.16.0

Clients:

Windows 7 x64 SP1 + current windows updates

Windows XP SP3

GPO with Point and Print restrictions enabled.

Users utilize Point and Print.

Problem:

Was examining a client's PrintService/Admin event logs and noticed some reoccurring entries stating the Xerox global print driver failed to install due to invalid signature, Error code=

800f024b.   Upon checking the actual .dll versions present in \\PCNAME\c$\Windows\System32\spool\drivers\x64\3\, they DID match the version on the print server.  Odd why Windows would then be complaining about

a failed driver install?

Other vendors UPDs (HP, Ricoh, etc) have not logged this error. The Xerox UPD is PackageAware.

Details:

Event logs:

Log Name: Microsoft-Windows-PrintService/Admin

Source: Microsoft-Windows-PrintService

Date: 7/10/2013 10:56:32 AM

Event ID: 600

Task Category: Client-side rendering

Level: Error

Keywords: Client Side Rendering (CSR),Classic Spooler Event

User: SYSTEM

Computer: PCNAME.MyDomain

Description:

The print spooler failed to import the printer driver that was downloaded from \\PRINTSERVER\print$\x64\PCC\ntprint.inf_amd64_neutral_e758378b95b6b97a.cab into the driver store for driver Xerox Global Print Driver PS. Error code= 800f024b. This can occur if there is a problem with the driver or the digital signature of the driver.

------------------

Log Name: Microsoft-Windows-PrintService/Admin

Source: Microsoft-Windows-PrintService

Date: 7/10/2013 10:56:32 AM

Event ID: 601

Task Category: Client-side rendering

Level: Error

Keywords: Client Side Rendering (CSR),Classic Spooler Event

User: DOMAIN\USER

Computer: PCNAME.MyDomain

Description:

The print spooler failed to download and import the printer driver from \\PRINTSERVER into the driver store for driver Xerox Global Print Driver PS. Error code= 800f024b.

Checking the contents of \\PRINTSERVER\print$\x64\PCC\ntprint.inf_amd64_neutral_e758378b95b6b97a.cab, it's just the PostScript and ntprint.inf files. There is nothing related to Xerox.  Odd.

Digging into \\PCNAME\c$\Windows\inf\setupapi.dev.log, one finds more details about the exact failure is due to

'UNIRES.DLL'.

>>> [Import Driver Package - C:\Windows\system32\spool\{FA90EB76-242F-4150-A362-3A8FBB37DB2F}\ntprint.inf]

>>> Section start 2013/07/10 10:56:27.591

cmd: C:\Windows\System32\spoolsv.exe

sto: Importing driver package into Driver Store:

sto: Driver Store = C:\Windows\System32\DriverStore (Online | 6.1.7601)

sto: Driver Package = C:\Windows\system32\spool\{FA90EB76-242F-4150-A362-3A8FBB37DB2F}\ntprint.inf

sto: Architecture = amd64

sto: Locale Name = neutral

sto: Flags = 0x0000000C

sto: Copying driver package files to 'C:\Windows\TEMP\{404a24de-0f2d-46a2-c9da-a30e91dcbd0d}'.

flq: {_commit_file_queue exit OK}

pol: {Driver package policy check} 10:56:30.555

pol: {Driver package policy check - exit(0x00000000)} 10:56:30.555

sto: {Stage Driver Package: C:\Windows\TEMP\{404a24de-0f2d-46a2-c9da-a30e91dcbd0d}\ntprint.inf} 10:56:30.555

inf: Opened INF: 'C:\Windows\TEMP\{404a24de-0f2d-46a2-c9da-a30e91dcbd0d}\ntprint.inf' ([strings])

inf: Opened INF: 'C:\Windows\TEMP\{404a24de-0f2d-46a2-c9da-a30e91dcbd0d}\ntprint.inf' ([strings])

sto: Copying driver package files:

flq: {_commit_file_queue exit OK}

sto: {DRIVERSTORE_IMPORT_NOTIFY_VALIDATE} 10:56:32.614

inf: Opened INF: 'C:\Windows\System32\DriverStore\Temp\{5ded2c15-82b3-44c9-c959-633d5454fb33}\ntprint.inf' ([strings])

sig: {_VERIFY_FILE_SIGNATURE} 10:56:32.614

sig: Key = ntprint.inf

sig: FilePath = C:\Windows\System32\DriverStore\Temp\{5ded2c15-82b3-44c9-c959-633d5454fb33}\ntprint.inf

sig: Catalog = C:\Windows\System32\DriverStore\Temp\{5ded2c15-82b3-44c9-c959-633d5454fb33}\ntprint.cat

sig: Success: File is signed in catalog.

sig: {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 10:56:32.645

sto: Validating driver package files against catalog 'ntprint.cat'.

!!! sto: Failed to verify file 'UNIRES.DLL' against catalog. Catalog = ntprint.cat, Error = 0xE000024B

!!! sto: Catalog did not contain file hash. File is likely corrupt or a victim of tampering.

!!! sto: Driver package appears to be tampered. Filename = C:\Windows\System32\DriverStore\Temp\{5ded2c15-82b3-44c9-c959-633d5454fb33}\ntprint.inf, Error = 0x800F024B

!!! sto: Driver package appears to be tampered, and it will not be installed.

!!! ndv: Driver package failed signature validation. Error = 0xE000024B

sto: {DRIVERSTORE_IMPORT_NOTIFY_VALIDATE exit(0xe000024b)} 10:56:32.661

!!! sto: Driver package failed signature verification. Error = 0xE000024B

!!! sto: Failed to import driver package into Driver Store. Error = 0xE000024B

sto: {Stage Driver Package: exit(0xe000024b)} 10:56:32.661

!!! sto: Failed to stage driver package to Driver Store. Error = 0xE000024B, Time = 2200 ms

<<< Section end 2013/07/10 10:56:32.677

<<< [Exit status: FAILURE(0xe000024b)]

As the Event Log entry stated (and the translated error code in http://answers.microsoft.com/en-us/windows/forum/windows_other-windows_update/error-code-800f024b/19fcf1e0-56be-4eef-a2bf-54f22f1a764f)

0x800F024B = SPAPI_E_FILE_HASH_NOT_IN_CATALOG.

I can only find really old versions of Winerror.exe and err.exe, neither which contain 0x800F024B SPAPI_E_FILE_HASH_NOT_IN_CATALOG; where does one find updated versions of these tools? Or is there a better location to translate error codes these days?

Why doesn't ntprint.cat contain the correct hash for UNIRES.DLL?