Search the VMware Knowledge Base (KB)
View by Article ID

How to cleanly remove the Network introspection driver (vnetflt.sys) (2149764)

  • 0 Ratings


The vsepflt.sys is the only driver required for normal Antivirus protection. The vnetflt.sys or vnetWFP.sys (for windows 10 and above) driver is called the NSX Network introspection driver. This driver captures networking events such as AD login/logout and all other normal networking traffic. This driver can be safely removed and does not effect AV if the AV is not configured to use network introspection.


To remove the vnetflt.sys:

  1. Log in to vSphere Web Client. 
  2. Mount VMware tools installer. (right click on VM > Guest > Install VMware tools > Interactive Install).
  3. Open auto play for Tools installing in the OS of the VM.
  4. Go to Setup64 and run as administrator.
  5. Modify Install > VMCI Driver Section > de-select NSX Network Introspection Driver > Finish.
  6. Reboot the VM.
    Note: This driver can only be removed If the VM is on at least 10.x version of VMware tools otherwise disable the driver in the registry. For more information, see Windows VM with NSX Network Introspection driver lose TCP connectivity (2148218).

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.


  • 0 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.

What can we do to improve this information? (4000 or fewer characters)

Please enter the Captcha code before clicking Submit.
  • 0 Ratings