Question

I have created an MSI package (Using InstallShield – IS) that installs my application along with the MS Postscript driver. My question mainly focuses on the postscript driver install part of the my overall installation process. I have created an IS custom action to run a command file (.cmd) at the correct time that installs the MS Postscript driver. The command file contains the following rundll32 line:
rundll32 printui.dll, PrintUIEntry /ia /m "AppX PS" /h "x64" /v "Type 3 - User Mode" /f "c:\(install)\afprint.inf" /F "%windir%\inf\ntprint.inf" .

The above works great accept for the fact I am pestered by a Microsoft Warning box which requires user input. The box includes the title: Windows can’t verify the publisher of this driver software. I can select the option “Install this driver software anyway” and the whole process does work. I did research this and there does not appear to be a way to avoid the warning even if I add “run quiet” switches to the PrintUIEntry method. Obviously, I need to sign my driver to avoid the security box, but where? I have no binary code here. My install uses a custom INF file that simply delegates to Microsoft (via ntprint.inf) for the Postscript driver install. The Postscript Driver is already on the OS. I am only supplying a PPD file. What exactly do I need to sign is my main question? How can I do this as I am unfamiliar with driver signing?

I am running this on windows 2008 R2 x64.

Here is a copy of my INF afprint.inf (it’s small):

[Version]
Signature="$Windows NT$"
Provider=%AF%
ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318}
Class=Printer
DriverVer=05/17/2007,1.0.0.1

[Manufacturer]
%AF%=Arbfile,NTamd64

[Arbfile]
"AppX PS" = AFCLIENT,,

[Arbfile.NTamd64]
"AppX PS" = AFCLIENT,,

[OEM URLS]
"Arbfile"   =   "http://www.arbfile.org"

[AFCLIENT]
CopyFiles=@AFCLIENT.PPD
DataFile=AFCLIENT.PPD
DataSection=PSCRIPT_DATA
Include=NTPRINT.INF
Needs=PSCRIPT.OEM,PSCRIPT_DATA

[DestinationDirs]
DefaultDestDir=66000

[Strings]
AF="Arbfile"

thanks for any help

Answer 1

Add a CatalogFile directive to the [Version] section of your inf file, use inf2cat to generate a cat file, then use signtool to sign the cat file.

If you use a certificate that is cross-signed by Microsoft, then the installer security warning will not appear.

You can find inf2cat and signtool in the WDK.