Windows Problems

Running Elevated

Every command that changes the machine must run in an elevated PowerShell. Otherwise, conflux exits with code 13 and prints the command to run again:

conflux: bringing up a network interface needs Administrator.
  open PowerShell with "Run as administrator", then:  conflux up

Open PowerShell with Run as administrator and run the line that conflux printed. Membership of the Administrators group is not enough, because the PowerShell session itself must be elevated.

The Wintun Driver

In TUN mode, conflux up gives the host a network interface. On Windows, this needs the Wintun driver, wintun.dll. conflux proxy needs no driver.

Conflux downloads the driver the first time it needs it, and again at any start that finds it missing, such as the first start after an upgrade. It refuses any download that does not match the pinned digest:

Conflux stores the driver next to the anchor binaries. The supervisor downloads it before it starts the anchor, so a reboot after an upgrade needs no commands. If the download fails, the supervisor retries.

Offline installation

On a machine with no route to wintun.net, conflux prints the steps to take by hand:

conflux: a network interface on Windows needs wintun.dll, and it could not be fetched: …

  Download wintun-0.14.1.zip from https://www.wintun.net and put
  bin\amd64\wintun.dll at:
    C:\ProgramData\conflux\bin\998ece52739a7c74\wintun.dll

  Or run "conflux proxy PORT=BACKEND", which needs no interface at all

If you cannot install the driver at all, use conflux proxy instead. It is a fully supported way to use the overlay. See Proxy and TUN Modes.

If the download does not match the pinned digest, conflux refuses it and prints both digests:

conflux: the downloaded archive is not the pinned one.
  expected sha256 07c256185d6ee3652e09fa55c0b673e2624b565e02c4b9091c79ca7d2f24ef51
  got      sha256 …

Defender and SmartScreen

Conflux writes a large executable to disk and runs it with elevated privileges. Endpoint protection may treat this as malware and quarantine the anchor binaries. When the binaries will not run, conflux names endpoint protection as the likely cause:

conflux: the anchor binaries were extracted to C:\ProgramData\conflux\bin\998ece52739a7c74 but will not run from there.
  an endpoint protection product may have quarantined them: a program that writes and then
  runs a 30 MB executable is a shape scanners are suspicious of.
  check the Defender protection history, and exclude that directory if this is expected.

To fix it:

• Check the Defender protection history for the anchor binaries.
• Run conflux version, which prints the SHA-256 digests of both anchor binaries. Check them against the release notes.
• Exclude %ProgramData%\conflux\bin. Conflux always extracts the binaries to this fixed directory.

Directory Permissions

Conflux restricts %ProgramData%\conflux to SYSTEM and Administrators. It refuses to use the directory if another account created it first, because that account could have put files in it. The message names the owner:

conflux: C:\ProgramData\conflux belongs to DOMAIN\account (SID), which is not an administrator, so conflux did not create it and will not use what is in it.
  Remove it, then run this again as Administrator. If it is left over from conflux itself, running any conflux command as that account once repairs it

Remove the directory that the message names, and run the command again as Administrator. The same fix applies to the message … was made by another account before conflux secured …, which names a file or folder inside the directory.

The Service and Its Log

Conflux registers a Windows service with these settings:

The service writes its output, and the anchor's, to the log file. To read the end of the log, run:

> Get-Content -Tail 50 "C:\ProgramData\conflux\logs\conflux.log"

When the supervisor stops itself with exit code 70 or 78, Windows reports the service as stopped, not failed. The recovery actions therefore do not restart it into the same failure. The log records the reason.

To learn how the supervisor retries and when it gives up on every platform, see Service and Logs.