I ran into an issue installing XProtect 2025 R3 on a fresh Windows Server 2025 VM in Google Cloud that initially looked like an IIS/certificate problem but turned out to be an issue with netsh
The installer fails during SetupIisTask with:
ServerAdminException: Cannot add SSL certificate
ConfiguratorI.log contains:
SSL port not found for HTTPS binding
Expected SSL port: '443', found string: 'Invalid Top Level command name: (null)'
Cannot add SSL certificate
Reinstalling, clearing certificates, or removing HTTP.sys SSL bindings did not fix the issue.
The problem is caused by a broken NetKVM netsh helper installed with the Red Hat VirtIO drivers.
Every netsh command outputs:
Invalid Top Level command name: (null)
Invalid Top Level command name: (null)
Invalid command name: (null)
Invalid command name: (null)
XProtect parses the output of netsh http show sslcert to verify the HTTPS binding it just created. The binding is actually created successfully, but the unexpected lines cause the parser to fail and the installer aborts.
The broken registry entry is:
HKLM\SOFTWARE\Microsoft\NetSh
NetKVM = C:\Windows\System32\netkvmco.dll
Fix
Remove the NetKVM helper before running the installer:
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\NetSh' -Name 'NetKVM'
Verify the issue is gone:
(& netsh http show sslcert | Where-Object { $_ -match 'Invalid' }).Count
This should return 0.
No reboot is required, and this does not affect the VirtIO network driver—it only removes the optional netsh NetKVM diagnostic extension.
After doing this, the XProtect installer completed successfully on the first attempt.