Removing ghost network adapters in Hyper-V virtual machines

One of the problems that most Hyper-V admins encounter sooner or later is that of ghost network adapters. A ghost network adapter, which is sometimes called a phantom NIC, is a network adapter that is defined within the guest operating system, but is not associated the virtual machine’s configuration.

There are at least a couple of different ways that a ghost network adapter can come into being. The most common cause is physical to virtual (P2V conversions). If you convert a physical machine into a virtual machine, then the machine’s operating system will still contain a reference to the physical network adapters that the machine had been using. Of course these network adapters no longer exist once the machine has been virtualized, so the adapters become ghosts.

A similar problem can occur if you alter a virtual machine’s configuration. Suppose for a moment that you delete a virtual network adapter and then create a new one. Even if the new virtual network adapter is identical to the old one, the guest Windows operating system sees the old and new virtual network adapters as two different adapters.

In either case, the NIC no longer exists, but it is still defined within the Windows registry.

For the sake of demonstration, I created a virtual machine containing two different virtual network adapters. Windows (the guest OS) identified these adapters as Ethernet and Ethernet 2. I then powered off the virtual machine, deleted one of the virtual network adapters, and created a new virtual network adapter that was identical to the one that I deleted. As you can see in the figure below, this new virtual network adapter is identified by the guest OS as Ethernet 3. In other words, the guest operating system detects the underlying virtual hardware change, even though the deleted and the new virtual network adapters are identical to one another.

Windows sees the old and new virtual network adapters as being two different adapters even though they are identical.

So why does any of this matter? Imagine for a moment that you have decided to do a P2V conversion on a physical server that is performing some sort of critical role. Let’s also assume that this particular server has been assigned a static IP address and that it needs to continue to use the same address once it has been virtualized.

When you boot the machine after it has been virtualized, you will have to manually assign the IP address to the virtual network adapter. When you do however, you will see a message telling you that another adapter is already using the address. Some versions of Windows are more forgiving than others when it comes to a ghosted network adapter holding on to an IP address that you want to reassign. In the figure below, Windows actually asks you if you want to release the address from the ghost adapter. Other versions will simply give you the option of ignoring the problem and thus assigning the same address to both the ghost and to the new virtual NIC. Other versions of Windows (particularly the older ones) won’t allow you to assign an IP address that is already bound to a ghost NIC.

This is an example of an error indicating that an IP address is already assigned to a ghost NIC.

This raises the question of how you can reclaim an IP address from a ghost NIC. The process for doing so varies depending on the version of Windows that is running on the VM.

Newer versions of Windows make it easy to get rid of a ghost NIC. All you have to do is to open the Device Manager and then select the Show Hidden Devices option from the View menu. This will cause the ghost NIC to be revealed. At that point, you can right click on the ghost NIC and use the Uninstall Device command to remove it.

You can tell the Device Manager to display hidden devices.

So what can you do if you are running an older version of Windows and Device Manager does not have an option to show hidden devices? Well, in those types of situations you can enter a command into an elevated Command Prompt window as a way of forcing the Device Manager to show the ghost devices. The command is:

Set devmgr_show_nonpresent_devices=1

You can see what this looks like below. Remember, you have to do this from an elevated Command Prompt (a Command Prompt with administrative privileges).

You may have to use this command to make the ghost NIC visible.

If you have an extremely old version of Windows, such as Windows Server 2003 or Windows 2000, then even this technique will not work. What you will have to do in those cases is to add devmgr_show_nonpresent_devices=1 to the server’s environment variables.

As a last resort, you can also try removing the ghost network adapter’s TCP/IP configuration directly from the registry. I strongly recommend making a backup before trying this, because you can severely damage the Windows operating system if something goes wrong. I also recommend that you avoid the temptation to try to remove the entire NIC using the registry. Instead, it’s better to focus on releasing the IP address.

To do so, open the registry editor and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. You will see several registry keys with long hexadecimal names. These each correspond to a network adapter. Expand each adapter and then expand the Parameters container beneath it to expose the Tcpip container. Edit the EnableDHCP registry key and change its value to 1, as shown in the figure below. This tells the adapter to use DHCP instead of a static IP address, this giving you the ability to reuse the address on another adapter.

You can change the value of EnableDHCP to 1 and remove the IP address and subnet.

You will also need to remove the IP address and the subnet mask, which you can see in the figure above. The next figure shows what this registry key looks like following the edits. You will need to restart the computer for the changes to take effect.

This is what the registry key looks like after the edits.

You will have to make similar changes at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Services\Tcpip\Parameters\Interfaces\{your GUID}.

As you can see, the degree of difficulty reclaiming an IP address from a ghost network adapter is proportional to the age of the operating system. Things have gotten easier over time. Thankfully, there are ways of releasing the IP address, even if you are running an old Windows version.

About The Author

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top