RVTools Fails to Launch with FIPS Enabled

Estimated reading time: 5 minutes

RVTools is a popular Windows-based utility which provides vSphere Administrators with a wealth of information about their environment: Hosts, VMs, Clusters, and more. Although true that Aria Operations (formerly vRealize Operations – vROPS) captures most of the attributes you can find in a standard RVTools report, it’s hard to beat the flexibility, speed, and simplicity of RVTools, especially given that it is still offered at no cost. In fact, cost is likely the primary driver behind selecting RVTools over similar utilities and solutions – it’s free and works well. This week, I updated RVTools on a Windows Server 2019 instance to the latest version at the time of this article, which is 4.6.1, released May 14, 2024. Although the release notes looked promising, this was my first experience where RVTools failed to launch following the software upgrade, which we will investigate in this post.

Symptoms

• Using the installation wizard, an “Installation Incomplete” message appears, stating “The installer was interrupted before RVTools could be installed. You need to restart the installer to try again.“.
• RVTools will not launch via the application shortcut nor elevated Command Prompt. You may notice in Task Manager that the RVTools.exe process executes and terminates within a couple of seconds.
• The Application log located in Windows Event Viewer reports two Error logs with Event IDs 1026 and 1000.

Related Factors

• The Windows desktop environment (client and server OS alike) is configured to require Federal Information Processing Standard (FIPS) compliant algorithms for encryption. This option is configured using the Local Security Policy (secpol.msc) snap-in or the Windows Registry.

Research and Review of Documentation

The first indication that something went sideways became evident when installing RVTools using the installation wizard. Recall that the “Installation Incomplete” message appears, stating “The installer was interrupted before RVTools could be installed. You need to restart the installer to try again.“, as pictured below.

This is certainly unusual, as I have installed and upgraded RVTools reliably on my workstations for several years. Aside from this message, there were no further indications that the installation failed, as the desktop icon was displayed as usual and the application appeared in the Add/Remove Programs window (accessed via Control Panel).

Attempts to launch RVTools using the desktop icon results in disappointment, as the application does not open the familiar connection window. In fact, nothing displays at all – as if nothing happened.

The first place to look for clues is the RVTools log file, which is now stored in the user’s AppData directory as of version 4.6.1:
C:\Users\myuserid\AppData\Local\RVTools\RVTools.log
Unfortunately, this log file was empty (0 KB) in my case, but it was a credible attempt.

The next place to check for clues is the Windows Event Viewer, specifically the Application log. Now we’re getting somewhere – there are two Error log records written at the time I attempted to launch RVTools, as pictured below:

Reviewing the log message content for the .NET Runtime record, we can gather some insight into what happened:

• The Application was rvtools.exe, so we can be certain that this is log is related to the issue at hand.
• The “Exception Info: System.InvalidOperationException at System.Security.Cryptography.SHA256Managed…” line indicates that an issue occurred when referencing this encryption algorithm. Per Microsoft Docs, “SHA256Managed” is not FIPS compatible.

Next, we should review the Application Error log message:

• Once again, the Faulting Application was rvtools.exe, so we can be certain that this is log is related to the issue at hand.
• Although referenced across a variety of unrelated software applications, there is mention online (using standard online search) of the Exception Code (0xe0434352) being triggered by enablement of FIPS on a local system.

Solution Assessment

Enabling FIPS is a valid and legitimate technical security control to mitigate risk of software applications using weak and/or deprecated encryption algorithms in attempt to secure communications. That said, if FIPS is enabled in your environment, it should only be disabled for testing purposes and/or in partnership with your Cyber Security resource(s). We will discuss two methods of toggling FIPS on/off below, as this is a Lab environment with FIPS enabled.

Local Security Policy Snap-In
Launch the Local Security Policy Snap-In by opening the Windows “Run” prompt (WIN+R then type “secpol.msc” and press the Enter key), then navigate to:
Security Settings > Local Policies > Security Options > System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing

Double-click on the “System cryptography: Use FIPS compliant algorithms for encryption…” item from the list, and a window will appear which allows you to tick a radio button to Enable/Disable the policy. In this case, we will tick the “Disable” radio button, then click on the “Ok” button to close the window.

Windows Registry Editor
Launch the Windows Registry Editor by opening the Windows “Run” prompt (WIN+R then type “regedit” and press the Enter key), then navigate to:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

Notice there is a single DWORD (32-bit) value titled “Enabled” with a hexadecimal Data value of 1. Double-click on the item to modify, then change the value from “1” to “0” and click on the “Ok” button. The value should now be set to 0, as shown below:

Wrapping Up

Now that FIPS has been disabled using one of the methods described above, RVTools should launch successfully. Although not explicitly stated in the Release Notes nor Product Documentation, I have confirmed with Dell Support (recall that Dell acquired RVTools in October of 2023) that FIPS is not currently supported and their Product Development Team is evaluating options going forward.