Lenovo Yoga on Windows 10

by Ed Sparks

Updated June 2016

It has often been a tricky process to locate all of the correct drivers for Windows-based systems after a clean install.  Windows 10 is doing a much better job of this in general, and Microsoft - somewhat controversially - is collecting and pushing newer (and hopefully more optimized) drivers via Windows Update. What's different from the past when using the Home or Pro versions of Windows 10, is the inability for users to opt out of these updates, except via a recently published tool.  We have to think this will get integrated into the OS UI directly at some point, but for now that's where things are at.
Update: they seem to have become much less aggressive at pushing these out, particularly video drivers. However, the Redstone builds still do not seem to have a native way to hide or block any updates, other than via delaying them via Windows Update for Business branches.

In our testing of the initial release of Windows 10 across various models, once again Lenovo consumer-class systems proved the most troublesome at getting all the functionality working smoothly.  What's particularly frustrating is the missing drivers are for core parts of the Windows 10 experience. None highlight this more than the Yoga 2 Pro and 3 models..

As convertible laptop/tablets they are prime candidates to utilize the Continuum feature built into Windows 10 to smoothly switch between a desktop focused and a tablet-oriented experience. Fire up your freshly installed copy of Windows 10 on these, however, and...it doesn't work. Continuum has no idea you have a tablet, and flipping the screen around leaves you with a keyboard and mouse happily typing away from your knees. Wonderful.

Navigating Lenovo's support site - even the one dedicated to Windows 10 - presents a sea of circular links and pages, none of which ever bring you to a solutionLikewise their forums are the usual endless cries for help, and little valuable or official information. What also doesn't help is that Lenovo continuously changes the names and types of software that they arbitrarily bundle the required drivers with. "Yoga Mode Control," "Harmony (Picks)," "Energy Manager" etc. Good luck making heads or tails of that.

We have to again wonder why on an OS where user experience is so important, and meant to further push sales of these convertible systems, this is not BUILT INTO the OS?  There can't honestly be that many different types of sensors and hardware that support this across the ecosystem.

So, what works?  We've found the following are what's needed after Windows 10 to make these systems fully functional...for now.  Note that these options seem to work across all the various Yogas and other Lenovo tablet like consumer products.

Install this (chipset) and this (DPTF) - to fix missing devices in Device Manager.
Update: These are often no longer needed in the newer builds of Windows 10 (1511 and Redstone 1607 Insiders).

Install ONLY  this on a Yoga 3  ("Yoga Mode Control") or this on a Yoga 2 Pro ("Harmony") to restore tablet functionality.  This software runs services that disable the keyboard and trackpad when you switch to tablet mode, and triggers Continuum to sense you have a two-in-one.
pdate: Install only one of the above that applies to the appropriate model.  Yoga Mode Control itself (first link) has been known to blue screen older Yoga 2 Pro based systems.  Harmony includes an older version of this driver.

Our advice: skip everything else on Lenovo's site, and let the OS handle the drivers.  It's mostly junkware.  Particularly their ridiculous "Energy Manager" and "OneKey Optimizer" software.


Creating a Bootable Windows 10 USB for Lenovo Systems

by Ed Sparks

Lenovo makes a great deal of excellent, well-engineered hardware, but Lenovo makes some of the world's most truly awful software. They seemingly could care less about the user experience.

Time and time again they prove this with crappy driver support, the unforgivable "Superfish" debacle, a dizzying array of pre-loaded bloatware (even on their corporate systems), confusing and slow websites and obscure design decisions.  Who would think to make users hit a tiny pinhead button you can barely see to enter the System Settings. Better yet, make them hold down the FN key, instead of just hitting the F keys at startup. 

For example, on a $1500+ high-end Ultrabook, they seriously provide this utility - in 2015 - to upgrade your firmware.  Spare us.

Much of Microsoft's excellent work with Windows is undone by this consistently ignorant vendor, who is allegedly one of their biggest and best partners.  With friends like these, hey?

It was no surprise then when we went to install Windows 10 on multiple Lenovo systems that, of course, the normal utilities didn't work. Even Microsoft's provided utilities to create a bootable USB to install from scratch failed on Lenovos.  One of our systems even blue screened with INACESSIBLE_BOOT_DEVICE after attempting the upgrade.  

By contrast, the Dell and HP systems we tried: smooth sailing.

The issue with booting from USB on Lenovo systems like Yoga 2 Pro, Yoga 3 Pro, etc. is that they use the newer (and now fairly common) UEFI instead of the old BIOS.  But they, unlike many other vendors, very specifically need to boot from a USB disk formatted with a more obscure compatibility MBR Partition Scheme AND FAT32 file system.  No other combination will work, and your shiny new Lenovo will happily and continuously ignore your USB drive at boot.  

Ignore the other advice you may find online about switching to Legacy Modes and things of the such in the UEFI Settings.  You'll get yourself in a bigger mess, and screw up Secure Boot and lower performance.

The solution is to download the excellent free utility Rufus, and use it to create the correctly configured USB disk.

1. Use Microsoft's utility to download the combination 32 bit and 64 bit ISO installer.
This was the only option we could consistently get to work correctly.Let Microsoft's 
utility create a USB drive, then copy all the files and folders in the root to a temporary 
folder on your hard drive.Incidentally, you can sure tell a lot of care and attention was
put into this utility, hey Microsoft? cestina? Great default.
2. Run Rufus and choose MBR partition scheme for BIOS or UEFI. Leave everything else the 
same and click Start.
3. When complete, copy all the files and folders from your temporary location back into the root of your USB disk.

4. Connect to your Lenovo system and it should boot correctly.If it's not set to boot from USB, power it off, then press the tiny tiny dot on the side to do a custom startup, and 
choose Boot Menu

Thanks, once again, for the adventure Lenovo.

EAP! Event logs are full of DLL path validation errors

by Ed Sparks

Once again, Tier 1 PC vendors are failing to send out products with proper drivers and clean, smoothly operating OS builds.  

It's shocking that in this era of Ultrabooks and tablets - all aimed at a premium market and with premium prices to match - vendors still send out systems littered with terrible bloatware, outdated drivers, and long lists of outstanding OS updates waiting.  Often even the OS is full version-behind or more behind current.

We're particularly looking at you Dell!

The latest cases we're seeing are from current Dell and Lenovo systems with Haswell ("4th Generation Intel Core") chipsets and Intel WiFi onboard.  On these systems, the System Event Logs are littered with entries similar to this:

The description for Event ID 2002 from source Microsoft-Windows-EapHost cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event: 
Eap method DLL path
25
9
0
0
The handle is invalid

As is also often the case the Corporate tech support sites were of no use, and the available driver updates from the vendor did nothing to clear the events or resolve the root cause.

Our own investigation found the issue appears to be some Cisco-specific EAP registry keys are being added, without proper driver or backing software.

The solution? Fire up our old friend RegEdit and look under the following registry path:

HKLM\System\CurentControlSet\Services\Eaphost\Methods\311

There will be several entries referencing paths for Cisco drivers or DLLs that don't exist. Remove any of these type of keys.

No reboot is necessary, and the errors go away immediately.

We've also found this resolves some Cisco and other third-party IPSec VPN issues as well.

806 - Actiontec Killed the VPN Star

by Ed Sparks

This was one of those "pull your hair out" cases, with a completely non-obvious cause and, thankfully, a surprise happy ending.

While troubleshooting a VPN connection problem for a client, we noted the inability to connect to some PPTP VPN servers while behind any TELUS (Canadian ISP) provided Actiontec V1000H DSL modem/router.

Of course, we didn't initially connect the dots, and tried all order of troubleshooting steps related to client OS (Windows 8, 8.1, 7 and 2008 all were unsuccessful, as was iOS). Strangely some Hyper-V hosted test VMs were able to connect, which indicates that they somehow must encapsulate the packets differently.

After much head-scratching and hyper-specific web searches, a few articles were found discussing Actiontec devices arbitrarily blocking GRE - the mysterious and troublesome protocol that allows PPTP to work.  

Sure enough, if we then tried all of the same devices connecting to PPTP over a cellular connection - bingo - they worked like a charm!  This ruled out the OS at least.

Sadly, these combo router/wifi/modems provided by telcos are wonderful non-user-serviceable and tend to be patched and upgraded at the whim of the provider.  We needed a resolution though, as these are widely deployed with our customers and their employees so this could be a big support nightmare.

In a rare win, however, TELUS came through and provided a heavily upgraded firmware for the device which not only resolved this issue, but improved the overall DSL connection speed and dramatically improved wireless range, stability and performance. As a bonus they've added IPv6 support internally, and for a future external deployment.

Solve your headaches: call TELUS (or your local equivalent) if you have an Actiontec V1000H or V2000H and ask for early access to the latest firmware.  It makes a dramatic difference.  You're VPNs and WIFI devices will thank you!

The magic firmware versions:
V1000H:   31.121L.11
V2000H:   31.122L.11

On the flip-side - the broken buggy firmware version appears to be 31.30l.57.

at.png

For another common and annoying issue with Windows L2TP VPNs  see our older article here.

Yes, we know PPTP is ancient and proven somewhat insecure, but it's still generally the easiest to get going for basic needs without all the bother of IPSEC or certificates.

Fix L2TP and PPTP VPNs on Windows Vista/7/8/2008/R2/2012

by Ed Sparks

Update 1: PPTP Broken? Read our latest article!

Update 2: Even more VPN grief - this time with Windows 8/8.1 Metro and PPTP.  See this article for the solution to "Error 850: The Extensible Authentication Protocol type required..."

 

For "security reasons" Microsoft somewhat broke the implementation for L2TP/IPSec (and in some cases PPTP) VPNs in Windows Vista/7/2008 R2.  This was due to an architectural change made in these OS versions to disable NAT Traversal functionality for these protocols by default.

This means that while your old XP machine or iPhone will connect, your brand new Windows 7 or 8 system will spin its wheels hopelessly and eventually error out.  Strange, non-obvious and questionable default choice, in our opinion.  You know you are likely experiencing this issue if you try to connect with L2TP and get errors numbers such as 800, 794 or 809.

Thankfully you can bring back the old behaviour with a couple of changes: a registry key and a Hotfix. 

On your Windows Vista, 7 or 8 client machine change or add the following registry item:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\

New DWORD (32-bit) Value:AssumeUDPEncapsulationContextOnSendRule 
Set the value to 2

This allows the client or server to be behind a NAT firewall.

Reboot after making the change, and retry the connection.  If there's still issues, you may have to apply the following Hotfix:

You cannot establish an IPsec tunnel to a computer that is running Windows 7 or Windows Server 2008 R2 through a NAT device

Better still?  Start using SSTP VPNs which will work through virtually any NAT or Firewall device much more consistently, and only requires a cheap or free public SSL certificate.  

This article has more information, and a link to Microsoft's extensive VPN guide.