Windows 10 v1909 Mac randomization on boot

JDubbedNJDubbedN Posts: 8Member, Beta Tester
Name Dropper First Comment Photogenic

Hello fingers,

I upgraded to Windows 10 version 1909 around the beginning of January 2020. Ever since then whenever I boot my computer up fing warns me of a new Mac address and blocks it. I have it setup to auto block new devices. Literally everytime my computer boots up a random Mac address is identified by fing. I've looked them up and I don't see any connection to any manufacturer or device. I've checked my actual real Mac address and it's nothing like the random ones being generated. My desktop is set to DHCP. If I unplug my ethernet cable and reboot, no random Mac. If I disable the network card in Windows settings and reboot, no random Mac.

According to fing the device goes offline within a minute of it going online. Fing shows it has no ip associated with it. I've tried safe mode with networking and the random Mac happens. If i boot into diagnostic startup only same random Mac happens. I am wondering if Microsoft introduced something to 1909 that would make this happen. I also thought maybe malware might be calling home and did run scans with Malwarebytes, windows defender and Avast. All clean.

Anyone have any ideas?

kltaylorCiaranRobinStopingads

Best Answer

  • JDubbedNJDubbedN Posts: 8
    Name Dropper First Comment Photogenic
    Accepted Answer
    I finally found the problem. And I don't know why it was causing it. The beta Desktop Fing software that I had installed and then uninstalled left a Windows service installed called Fing.Agent. It was running automatically. Even though I disabled it the random mac address still happened. And since the Fing software didn't do a proper job of uninstalling its software I had to resort to removing it manually through cmd using "sc delete Agent.Fing". That removed it, I rebooted and now no more phantom mac address's. I know the Fing desktop software is in beta but that is unacceptable. I wasted so much time believing my computer was compromised or it was the Windows 1909 update at fault. The irony was that it was the Fing software itself. Truly amazing. I hope this find helps the Fing developers and any user who bumps into this same problem. It truly was not an experience I would have liked to have lived through.
    il8rh8r

Answers

  • kltaylorkltaylor Posts: 760Moderator, Beta Tester
    500 Likes 500 Comments 25 Answers 100 Agrees
    ✭✭✭✭✭
    Hi @JDubbedN, welcome to our community.

    Windows 10 had the ability to randomize MAC addresses roughly about a year ago, but that was supposed to be 'removed'.  What makes me wonder if that's what's happening since you said that it still happens in Safe Mode.

    SM only loads OS-specific drivers and services, so I would lean towards it being an OS issue.

    Check this process to see if your wireless adapter has the function/feature (and I use that term lightly) is enabled.
    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
  • JDubbedNJDubbedN Posts: 8Member, Beta Tester
    Name Dropper First Comment Photogenic
    @kltaylor Thank you for your quick reply.
    I should have been more specific. This problem is happening on my wired ethernet connection. I did however, test a wireless adapter this morning and physically unplugged my ethernet cable. Problem went away. Which means this random mac issue is happening with the NIC only and not with a wireless adapter. I did look up Mac randomization and the option is no longer there on Windows 10 v1909 like you said Microsoft removed it. I uninstalled the driver for the NIC, seeing that it was a generic Microsoft driver from 2016, and went directly to the Realtek website and downloaded a 2019 driver for it. However, the random mac still appears on fing when I boot up. The NIC is built into the mobo so I cannot remove it. However, I could disable it permanently and install a new NIC and see if that gets rid of the problem. My thinking is the NIC is malfunctioning. Anymore thoughts send them my way. Thanks for the help.
  • kltaylorkltaylor Posts: 760Moderator, Beta Tester
    500 Likes 500 Comments 25 Answers 100 Agrees
    ✭✭✭✭✭
    Disabling the built-in Ethernet adapter on the motherboard could be an option, Ethernet adapters are relatively cheap these days, but I would take a different approach.

    Sounds like maybe the OS that you are experiencing this on could have held onto the 'feature' which honestly wouldn't surprise me.  I'd consider backing up your personal data and issuing a full OS refresh which "should" remove the feature.  You can download the Media Maker application from Microsoft, download the latest ISO and burn that to a DVD.  This would provide the most recent version of Windows 10.  Boot from that disc and reinstall the OS.
    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
  • ScoobyScooby Posts: 74Member
    25 Likes 5 Answers 10 Comments 5 Awesomes
    ✭✭✭
    Strange issue. I've never encountered it, but nothing would surprise me, at this point. :)
    Did you do a "clean install" upgrade, or did you upgrade with Windows 7 still present? If the latter, a clean install, as @kltaylor recommended, may help.  You may, also, want to check your computer manufacturer's web site, and see if they have any Windows 10 drivers available, for your computer. If there is a BIOS update, updating it, may help, too. If there are no Windows 10 ethernet drivers available, for your NIC, you could try Windows 8 or Windows 7 drivers, if those are available. It is possible Windows 10 may not let you install those, but it is worth a try, especially if the issue is still present, after a "clean install". Manufacturer drivers, even if older than the Realtek ones you obtained, may work better, as the Realtek drivers are "generic" in nature. Manufacturer drivers may have certain features enabled or disabled, depending on how they implemented the Realtek NIC with their product.

    As far as Microsoft removing the "random hardware addresses" from Windows 10, for wifi, it is still present on my Windows 10 1909 system. It seems to be dependent on your wifi card/NIC/drivers supporting it.


    Ciaran
  • JDubbedNJDubbedN Posts: 8Member, Beta Tester
    Name Dropper First Comment Photogenic
    Thanks for your responses @Scooby @kltaylor
    I may have to take this problem to a forum who specialize in Windows issues. I only started here because fing is catching it. However, to answer the questions asked...
    1. My Windows 10 originally came from a Windows 7 upgrade straight to Windows 10. However, I've had Windows 10 installed on my computer for many years and this problem only occurred after upgrading to Windows 10 v1909. Ironically, this was also the same time that I installed the beta version of Fing Desktop which I forgot to mention until now when I thought about it. But because Fing desktop is very limited I decided to uninstall it until it gets beefier. I am wondering if by installing Fing Desktop that it had some unintended side affects. I couldn't say.
    2. I performed a Windows 10 repair install. Problem still persists.
    3. I installed another NIC, disabled the onboard NIC and tested. Problem persisted on the newly installed NIC. Yet, the problem doesn't occur on wireless adapters. Very odd.
    4. I installed the manufacturer NIC drivers and problem persisted.

    I understand the "solution" to fixing many Windows problems is a quick reinstall of the Windows OS. However, if I did that I would have many weeks if not months of re personalizing my Windows environment, including installing software, activating software, configuring software. I would need to contact several companies to reset my license activation's for several of my softwares. It would be a real headache for sure just to fix a rogue mac address that could just be a fluke. It is definitely a concern but the operating system is fully functional. So at this point in time it is not cost effective to reinstall the OS and start from scratch. But it is always an option.

    I welcome any other ideas to troubleshoot. Thank you!


  • ScoobyScooby Posts: 74Member
    25 Likes 5 Answers 10 Comments 5 Awesomes
    ✭✭✭
    You could try uninstalling the "Feature Update to Windows 10 Version 1909":
    Start > Settings > Update & Security > View Update History > Uninstall updates
    That will open a new window. Look for "Feature Update to Windows 10 Version 1909 via Enablement Package (KB4517245)", and click it, to highlight it, and select "Uninstall". The "KB" number could be different, as I'm on a Windows "Home" edition.

    Another option could be going back to an earlier "Restore Point", before the 1909 update and Fing Desktop Beta was installed, and see if that helps.
    Ciaran
  • kltaylorkltaylor Posts: 760Moderator, Beta Tester
    500 Likes 500 Comments 25 Answers 100 Agrees
    ✭✭✭✭✭
    I understand the woes about reinstalling the OS on that machine, I get it.  I don't suggest that as the first method of fixing something.  @Scooby hit on another point that you can try to see if that fixes the issue, which is removing the update from the system and rebooting after.

    Since you used a secondary NIC card in the system and it still persisted, the problem didn't follow the NIC, it stayed with the system/OS.  Honestly, that's where the issue is especially if it's an upgrade from Windows 7 to Windows 10.

    If by uninstalling the update doesn't solve the issue, I can almost guarantee that any Microsoft support forums will echo the suggestion of doing a clean install, not a repair.  


    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
  • JohnJohn Posts: 104Moderator
    25 Likes 10 Comments 5 Agrees Founder
    ✭✭✭
     I can't see how the MAC will change, have you confirmed fing is showing the same mac as your adapter?  Do you have any virtual devices installed? 

    You can try:
    Start - > Run -> CMD
    then "ipconfig /allcompartments /all"

    will help you identify the adapter that fing is showing the mac for
    kltaylor
  • dynvordynvor Posts: 10Member, Beta Tester
    10 Comments Name Dropper Photogenic
    edited January 28
    I had the exact same problem had back and fo with fing support for weeks with no fix in the end i was messing with certain settings and i fixed the issue. What I did was goto start in windows then go to control panel then administration tools then services In services disable anything that has Hyper-v in each column on mine there are 9 of them after that it should be sorted and you wont get the problem any more hope this helps you. Also a friend of mine who also owns a fing was also having the problem but he sorted his out by going into the Bios and disabling anything that's to do with virtualisation.
  • kltaylorkltaylor Posts: 760Moderator, Beta Tester
    500 Likes 500 Comments 25 Answers 100 Agrees
    ✭✭✭✭✭
    Hi @dynvor, I apologize if there was an issue that you initially brought to us that we were unable to help you in any way with.

    What's interesting is the list of services that you said that you 'disabled' in Task Manager.  Hyper-V is a virtualization application to assist with the ability to run other Operating Systems within Windows 10.  There is information here, that you can see if something that Microsoft had integrated into Windows 10 Professional and higher versions.

    There also is information on how to activate the resource in Windows 10.

    The reason why the Fing app would see multiple MAC addresses on that machine would be to accommodate the virtual appliance network adapter, in order for it to use the host adapter (native to the hardware of that machine) and communicate to the world.

    I wonder if disabling the resource in Windows would be better, instead of disabling the service?
    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
  • JDubbedNJDubbedN Posts: 8Member, Beta Tester
    Name Dropper First Comment Photogenic
    @dynvor Thank you for that possible solution. Unfortunately I disabled all the hyper v Windows services and the problem still persists.
    @ktaylor I tried your method but hyper v is already unchecked.
    I am now receiving 2 random mac address's at the time same instead of the 1 a couple days ago. It would appear its growing or its because I added that second NIC. So now I have both an onboard NIC and a slotted NIC. Fing fills up real quick with generic blocked random mac address's that its starting to get a bit frustrating having to remove them manually one by one from within the fing app. I don't see a way to select multiple devices and delete them.
    @John No virtual OS's installed. The mac address is random every time and never matches my physical NIC's mac address. I tried ipconfig /allcompartments /all and it only shows my 1 NIC.

    Thank you for the continued ideas. I am still troubleshooting myself. I'll post if I come up with a solution.
  • JohnJohn Posts: 104Moderator
    25 Likes 10 Comments 5 Agrees Founder
    ✭✭✭
    @JDubbedN
    does the mac from your ipconfig match that from fing, i.e. does it change also with every boot?
  • ScoobyScooby Posts: 74Member
    25 Likes 5 Answers 10 Comments 5 Awesomes
    ✭✭✭
    Performing a "clean boot" may help with the troubleshooting, if you haven't found this already:
    Although you shouldn't have to do this, it would be interesting to see if the issue stopped, if you "set" your mac, to your actual mac, or "set" it to something else, within windows. Steps to change your mac within Windows here:
    My (limited) experience with ethernet adapters are, usually, they are disabled in the BIOS, work, or don't work. It almost seems as if the Windows 10 wifi mac randomization is happening with the ethernet adapter.
    Hope you figure it out!


  • NanoNano Posts: 1Member
    First Comment
    I am having the exact same troubles.  I disabled the onboard ethernet controller.  I purchased and installed a new controller.  I am not buying the install or roll back windows ideas.  This has been going on since the 1903 update for me.  All the code for 1909 is in the 1903 update the 1909 just turns on the switch.  I rebooted my Fingbox today and the first thing that happened was that it asked me to recognize my PC.  I did so and have not had a problem for about 5 hours.  My Fingbox has always been set up to not block new devices. 
    With the new nic the link and activity lights stay on even when my windows os tells me I have no internet.  This seems like Fing blocking.  If it was hardware, the lights would be out.  I purchased my Fingbox to monitor my ISP as they were having a lot of outages.  They finally fixed the problem which was at the cable box on home exterior.  If this keeps happening, the next test will be to unplug Fingbox.
    I would like to see Fing get a lot more conversant with the changes in 1903 and 1909.  I suspect that it is the combination of hardware and software at work here. 
  • JohnJohn Posts: 104Moderator
    25 Likes 10 Comments 5 Agrees Founder
    ✭✭✭
    JDubbedN said:
    I finally found the problem. And I don't know why it was causing it. The beta Desktop Fing software that I had installed and then uninstalled left a Windows service installed called Fing.Agent. It was running automatically. Even though I disabled it the random mac address still happened. And since the Fing software didn't do a proper job of uninstalling its software I had to resort to removing it manually through cmd using "sc delete Agent.Fing". That removed it, I rebooted and now no more phantom mac address's. I know the Fing desktop software is in beta but that is unacceptable. I wasted so much time believing my computer was compromised or it was the Windows 1909 update at fault. The irony was that it was the Fing software itself. Truly amazing. I hope this find helps the Fing developers and any user who bumps into this same problem. It truly was not an experience I would have liked to have lived through.
    Glad you to to the bottom of it this is one to escalate @Ciaran @VioletChepil.  
    Was this actually changing your mac or just detecting it incorrectly?

  • JDubbedNJDubbedN Posts: 8Member, Beta Tester
    Name Dropper First Comment Photogenic

    @John To my knowledge it was not changing my NIC's mac address. I would run ipconfig /all and the mac address for my NIC would stay the same. But for some unexplained reason something with the Agent.Fing service was temporarily creating a rogue/phantom randomized mac address every boot. Maybe it was malfunctioning because the uninstall left remnants of the beta fing desktop software. Or maybe that's how the beta fing desktop software works, by using some kind of virtual network service and the fing box isn't supposed to recognize the random mac addresses. Maybe the fing dev's can make sense of it. All I know is as soon as I force removed the Agent.Fing services problem went away.

  • JohnJohn Posts: 104Moderator
    25 Likes 10 Comments 5 Agrees Founder
    ✭✭✭
    JDubbedN said:

    @John To my knowledge it was not changing my NIC's mac address. I would run ipconfig /all and the mac address for my NIC would stay the same.

    Ah that's the bit of info that would have helped know it wasn't a driver or windows issue but glad you got the the bottom of it eventually!
  • JDubbedNJDubbedN Posts: 8Member, Beta Tester
    Name Dropper First Comment Photogenic

    @John I thought I had already answered that question above previously. Please see quote. Maybe not. Anyways problem solved. Thanks.

    "@John No virtual OS's installed. The mac address is random every time and never matches my physical NIC's mac address. I tried ipconfig /allcompartments /all and it only shows my 1 NIC."

  • JDubbedNJDubbedN Posts: 8Member, Beta Tester
    Name Dropper First Comment Photogenic
    New update! I realized after troubleshooting a recent issue that Windows Event Log service was disabled. When I enabled it and rebooted Fing Box recognized the phantom mac address again. I've toggled the Windows Event Log service and have been able to reproduce the problem every time. So the culprit is the Windows Event Log service. This was not a problem in winver 1809 but surfaced on winver 1909. So my question is why would this be happening and why is the Windows Event Log producing a phantom mac during boot and the Fing box is picking up on it?
Sign In or Register to comment.