ndis.sys BSOD When using VPN

Question

ndis.sys BSOD When using VPN

FG 21

Hello!

Ever since I had my new notebook at my company, every time I try to connect to VPN it crashes with the following BSOD:
ndis.sys
the message is either one of the following:
KMODE_EXCEPTION_NOT_HANDLED
or
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

The system builds up the connection, and as soon as the connection is established, I get the BSOD.
The error occurs on WiFi, LAN port, even on an external USB WiFi device.
I have a Lenovo Legion 5 15IMH6, Intel(R) Core(TM) i7-10750H CPU
Windows version: Win10 Enterprise N LTSC (10.0.19044 build 19044)
The error persists for months now, in the meantime I had several windows and other system updates, but It became very important for me to use VPN now, so I only digged deeper into the problem in the past days.

I have read several forum entries, but nothing got me further.
The most useable was this: https://learn.microsoft.com/en-us/answers/questions/835823/bluescreen-using-vpn-100-reproducible.html
I have already done the following:

Updated my drivers (Intel, Lenovo)
Tried other VPN softwares (Originally my company uses Sophos Connect, but I have tried OpenVPN GUI and OpenVPN Connect)
Uninstalled and Reinstalled VPN Software
Uninstalled and Reinstalled TAP drivers (even with manual deleted from System32\drivers , like tap0901.sys and tapsophos.sys)
Tried to login with different user/pass
Did the Virus scan
Did the disk cleanup
crawling through log files..

Every time, I get the same result.

I ran the V2 log collector, and I have posted the results here: https://drive.google.com/file/d/1lQcaQWX8c6KtPL3v89z5wWsErkXsPCBz/view?usp=sharing
Sorry, please note that this contains confidental information, so I have to grant access manually to a person who can look into this. I cannot leave the Link on public.
disclaimer: I have a Hungarian windows system, so the log file texts are according to that. Please handle the information confidentally.

I would really appreciate some guidance on how to proceed.

Thank you in advance!

Gary Nebbett 6,211 Reputation points

2022-12-09T10:00:17.197+00:00

Hello FG,

What is the reason for not using the built-in Microsoft VPN client? Is it a case of VPN protocol support, authentication mechanism support or something else?

Many third party VPN clients use a TUN/TAP mechanism to implement VPN functionality but the built-in mechanism uses Windows Filtering Platform (WFP).

Completely uninstalling all TUN/TAP software and using the built-in client (if possible) would be my first suggestion.

Gary
FG 21 Reputation points

2022-12-09T10:11:08.177+00:00

Hello Gary!

Thank you for the quick reply.
My company uses secure OpenVPN Protocol, therefore, I have an .ovpn file which contains the certificates etc. As far as I know, Windows doesn't support this protocol. Am I wrong here?

Sincerely,
Gabor
Gary Nebbett 6,211 Reputation points

2022-12-09T10:50:46.187+00:00

Hello Gabor,

Sorry, my mistake. I think that Sophos supports IPsec and an "SSL" (TLS) based VPN protocol and I thought that OpenVPN did too.

If your company only allows connections with the TLS based protocol then the Windows client cannot be used.

Gary

4 answers

Your answer

Gary Nebbett 6,211 Reputation points

2022-12-09T10:00:17.197+00:00

Hello FG,

What is the reason for not using the built-in Microsoft VPN client? Is it a case of VPN protocol support, authentication mechanism support or something else?

Many third party VPN clients use a TUN/TAP mechanism to implement VPN functionality but the built-in mechanism uses Windows Filtering Platform (WFP).

Completely uninstalling all TUN/TAP software and using the built-in client (if possible) would be my first suggestion.

Gary
FG 21 Reputation points

2022-12-09T10:11:08.177+00:00

Hello Gary!

Thank you for the quick reply.
My company uses secure OpenVPN Protocol, therefore, I have an .ovpn file which contains the certificates etc. As far as I know, Windows doesn't support this protocol. Am I wrong here?

Sincerely,
Gabor
Gary Nebbett 6,211 Reputation points

2022-12-09T10:50:46.187+00:00

Hello Gabor,

Sorry, my mistake. I think that Sophos supports IPsec and an "SSL" (TLS) based VPN protocol and I thought that OpenVPN did too.

If your company only allows connections with the TLS based protocol then the Windows client cannot be used.

Gary

Answer 1

FG 21

Dear Everyone!

I got the problem solved.
I have Siemens TIA Portal Installed on my Notebook, which earlier had no conflict with VPN at all.
Somehow that changed...
I managed to find an entry on the Siemens forum.
The solution was what stated here: https://support.industry.siemens.com/forum/hu/en/posts/tia-portal-v17-conflict-with-vpn/262291

Try to deactivate the option
SIMATIC Industrial Ethernet (ISO)
for the SSL VPN Virtual Ethernet Adapter

(Under ethernet interfaces, right click on the TAP adapter, then remove the tick next to "SIMATIC Industrial Ethernet (ISO) ")

This solved my problem!

I really appreciate all of your help!

Nolan 0 Reputation points

2023-02-09T15:45:22.8066667+00:00

This worked for me! THANKS!!!!!!!!!!!
Francesco Amoia 0 Reputation points

2023-02-17T08:48:22.47+00:00

This worked for me also!!! THANK YOU!!!!

Control Box Service 0

the problem was just that... after several months in which I had to do without OpenVPN, finally the solution to the problem. I had tried everything from program updates, drives, uninstalls and re-installs.
THANK YOU!

Александр Диденко 0 Reputation points

2024-02-12T11:57:13.89+00:00

By installing the ABT Site program from Siemens, a sea of additional programs, drivers and changes in Windows were installed.

After that, when connecting to a VPN (OpenVPN), Windows goes into BSOD and says that the problem is in ndis.sys.
What have I not tried to do...
But disabling the checkboxes shown in the video helped.
Go to "View network connections".
Then, in the properties of each network driver, disable PROFINET, SIMATIC, NDIS.
And finally the blue screen will stop appearing.

https://www.youtube.com/watch?v=76ExefB4pB8
EGNBR 1 Reputation point

2025-05-16T11:11:20.9233333+00:00

I had the same problem with other Siemens programs. Step 7 5.7 for example.

If you go in trouble and have a Siemens tool installed, check all parameters in your VPN virtual adapters and disable "SIMATIC Industrial Ethernet (ISO)".

Be attention, some VPNs create new virtual adapters at boot and you will need to change this parameter in all VPN virtual adapters.

Answer 2

Łukasz Wiąckowski 5

I also found solution. I unchecked all unnecessary protocols (for virtual network cards used by OpenVPN) as below on the picture:

NDISsettings

Laurent Jedeloo 0 Reputation points

2025-06-10T14:25:48.43+00:00

Thank you so much, this solve my BSOD problem. Later I will check one by one which of the option caused the problem, but after 2 days of installing, uninstalling, installing, copilot, chatgpt, grok this was the thing!

Answer 3

FG 21

Some update:
I have ran a debug on the crash dump of the two types of BSOD that I mentioned.

The results are here:
https://drive.google.com/file/d/18Je1QFwQOOUxtgZh-J-on-xaEPm2oFsJ/view?usp=sharing,
https://drive.google.com/file/d/1uhWJwXMV4BU3WV-klFPMFW8MBZEJ5519/view?usp=sharing

These indicate that the root of the problem is either ndis.sys and/or wfplwfs.sys

Do you have any suggestions what to do with these drivers? Can I download an other, stable version of these? Let alone, hardcopy them from an other, functioning notebook?

Gary Nebbett 6,211 Reputation points

2022-12-09T13:01:34.42+00:00

Hello Gabor,

The two drivers that you mention are unlikely to be the cause of the problem. As EckiS indicates, it is probably the TUN/TAP driver(s) causing the problem (e.g. tap_ovpnconnect). That driver is directly implicated in one of the dumps; the other dump is inconclusive - it suggests to me that it was caused by some harmless code "tripping-over" some damage that had been caused earlier (possibly (or even probably) by the TUN/TAP drivers).

Are you sure that your company does not provide an IPsec option in its Sophos configuration?

Gary

Answer 4

EckiS 916

at least your second dump has "tap_ovpnconnect" on the call stack, so this might be the reason for the crash.
Similar callstack as here:
Crash Win 10 MiniDumpl

FG 21 Reputation points

2022-12-09T13:09:49.697+00:00

Yes, but I have already tried several times installing, uninstalling sophos and openvpn. With Sophos, the problem source is "tapsophos".
https://drive.google.com/file/d/15gTwysg473m7veonBxuV269OcLyL0PKr/view?usp=sharing

Different types of TAP-adapers cause the same results.
My guess the problem is with either ndis.sys and/or wfplwfs.sys. Therefore, I have no idea how or what to update to fix those (except Win reinstall, but I rather not do that, bcs of some softwares I have installed)

Share via

ndis.sys BSOD When using VPN

4 answers

Your answer