How to Find Drivers for Unknown Devices in the Device Manager Chris Hoffman @chrisbhoffman Updated July 5, 2017, 7:26pm EDT Unknown devices show up in the Windows Device Manager when Windows can’t identify a piece of hardware and provide a driver for it. How about adding something like a 'Monitor drivers' feature to Process explorer where it uses the same sequence of debugging steps to maintain a list of non-microsoft device drivers that frequently use a lot of cpu? I know some would always be expected to show up but perhaps these can be marked as known and then unknown ones highlighted?

I listen to Tim, Tony, Chris et al talking on LMTV about networking and I realise how little I know about real networking; you know that layers 1 to 3 stuff. I m a layer 4 to 7 type of guy, and so I m always going to push the boundaries on this forum. Have I gone too far this time. Let s see.

I saw a post on another forum this week from a guy who had a particular problem with files on a Windows server. A user deleted a file, but when he came back in the following day it had reappeared. So he deleted it again and blow me if it didn t pop back up the next day.

In this short video

we take a look at using the excellent and free Microsoft Process Monitor to investigate the problem and analyze access to a network share.

MP4 download here in case YouTube is blocked

A few additional considerations if you re going to try this:

Test the procedure during a change management slot as usual

If you are going to run the capture for a long period, change the procmon Backing Files setting to point to a local directory or a share rather than to pagefile.sys

I also forgot to mention something in the video. You ll see that I refer to file operations performed by the System process. If you double-click on one of these and click on the Stack tab you ll see something like this.

Note the references to srv2.sys. This is the file server code running as a software driver in the kernel.

So that s it. See if you can spot the mention of the word network in the video - it ll make it all worthwhile.

Best regards.Paul skating on the very edge of LMT

Author Profile - Paul Offord has had a 36-year career in the IT industry that includes roles in hardware engineering, software engineering and network management. Prior to founding Advance7, he worked for IBM, National Semiconductor and Hitachi Data Systems.

Paul and the problem analysts at Advance7 help IT support teams in many business sectors to troubleshoot difficult performance and stability problems. Paul played a key role in the development of the RPR problem diagnosis method and is currently leading a project to explore new ways to help IT support people learn troubleshooting skills.

Learn what other IT pros think about the 1000 Error event generated by Application Error. Get answers to your event log question in minutes.

Aug 13, 2012 In this 2 part episode of Defrag Tools, Andrew and I walk you through Sysinternals Process Monitor. Process Monitor allows you to view the File, Registy.

Micca media player delete hidden files mac os x. Update - we are seeing this issue less these days. Are many of you still having this issue. If so, please describe for me in the comments section so I can see if I.

Jul 29, 2008 Hi all, The other day I had to troubleshoot an issue with a process that a specific Windows service was trying to launch without success. We could see with.

Process Monitor fails to load

TechNet Blogs Ajith s blog Debugging an application crash using procmon without memory dump. hmm. Seriously.

TechNet Blogs Microsoft Enterprise Networking Team Missing Network Map under Network and Sharing Center in Windows Vista or Windows Server 2008.

Installing printers for RDP is seldom straight forward, but when it comes to HP super-user-friendly driver installs it s super interesting.

I am trying to load Process Monitor Procmon.exe from Sysinternals, and I get the following error on startup. Unable to load Process Monitor device driver In the.

I am trying to load Process Monitor Procmon.exe from Sysinternals, and I get the following error on startup.

Unable to load Process Monitor device driver

In the Event Viewer, I get the following.

Driver PROCMON11.SYS has been blocked from loading.

What is blocking it from loading.

Background information: I have no anti-virus or malware checker software installed, other than Windows Defender which I think is part of Windows 7.

I listen to Tim, Tony, Chris et al talking on LMTV about networking and I realise how little I know about real networking; you know that layers 1 to 3 stuff. I m a.

-->

As you’ve probably surmised by my blog posts and other writings, I like knowing exactly what my systems are doing. I want to know if a process is running away with the CPU, causing memory pressure, or hitting the disk. Besides keeping my computers running smoothly, my vigilance sometimes helps me spot performance and reliability problems in Windows and third-party code.

The main way I keep tabs on things is to configure Process Explorer to run automatically when I log in. Whenever I configure a new computer, I add a shortcut to Process Explorer to my profile’s Start directory that includes the /t (minimize) switch. Process Explorer runs otherwise hidden with tray icon that shows a small historical view of CPU activity level. Because I want access to detailed information about system processes, as well as my own, I also specify the /e option on Vista, which causes Windows to present a UAC prompt on logon that allows me to grant Process Explorer administrative rights.

Because I keep an eye out for CPU spikes in Process Explorer’s tray icon, which show up as green or red for user-mode (application) and kernel-mode (operating system and drivers) CPU usage, respectively, I’ve identified several application bugs over the last few months. In this post, I’ll share how I used both Process Explorer and another tool, Kernrate, to identify a problem with a third-party driver and followed the problem through to a fix by the vendor.

Not long after I got a new laptop several months ago, I noticed that the system sometimes felt sluggish. Process Explorer’s tray icon corroborated my perception by displaying a mini-graph of red CPU activity. The icon opens a tooltip that reports the name of the process consuming the most CPU when you move the mouse over it, and in this case the tooltip showed the System process as being responsible:

The first few times I noticed the problem, it resolved itself shortly after and I didn’t have a chance to troubleshoot. However, I could see by opening Process Explorer’s System Information dialog that the CPU spikes were significant:

The System process is special because it doesn’t host an executable image like other processes. It exists solely to host operating system threads for the memory manager, cache manager, and other subsystems, as well as device driver threads. These threads execute entirely in kernel mode, which is why System process CPU usage shows up as red in Process Explorer’s graphs.

I suspected that a third-party device driver was the cause of the problem, so the first step in my investigation was to figure out which thread was using CPU, which would hopefully point me at the guilty party. I watched vigilantly for signs of trouble every time I switched networks and jumped the first time I saw one. Process Explorer shows the threads running in a process on the Threads page of the Process Properties dialog, so I double-clicked on the System process and switched to the Threads page the next time I noticed the CPU spike:

The “ntkrnlpa.exe” prefix on each thread’s start address identified the ones I saw at the top of the CPU usage sort order as operating system threads (Ntkrnlpa.exe is the version of the kernel loaded on 32-bit client systems that have no execute memory protection or server systems that need to address more than 4GB of memory). Because I had previously configured Process Explorer to retrieve symbols for operating system images from the Microsoft public symbol server, the thread list also showed the names of the thread start functions. The most active threads began in the ExpWorkerThread function, which means that they were worker threads that perform work on behalf of the system and device drivers. Instead of creating dedicated threads that consume memory resources, the system and drivers can throw work at the shared pool of operating system worker threads.

Unfortunately, knowing that worker threads were causing the CPU usage didn’t get me any closer to solving identifying a root cause. I really needed to know what functions the worker threads were calling, because the functions would be inside the device driver or operating system component on whose behalf the threads were running. One way to look inside a thread’s execution is to look at the thread’s stack with Process Explorer. The stack is a memory region that stores function invocations and Process Explorer will show you a thread’s stack when you select the thread press the Stack button or double-click on the thread. On Vista, however, you get this error when you try and look at the stack for threads in the System process:

The System process is a special type of process on Vista called a “protected process” that doesn’t allow any access to its threads or memory. Protected processes were introduced to support Digital Rights Management (DRM) so that hi-definition content providers can store content encryption keys with a reduced risk of an administrative user using DRM-stripping tools to reach into the process and read the keys.

That approach foiled, I had to find another way to see what the worker threads were doing. For that, I turned to KernRate, a command-line profiling tool that’s a free download from Microsoft. KernRate can profile user-mode processes and kernel-mode threads. It uses the sample-based profiling facility that was introduced in the first release of Windows NT, which records the unique addresses at which the CPU is executing when the profiling interval timer fires. When you stop a profile capture, Kernrate retrieves the information from the kernel, maps the addresses to the loaded device drivers into which the fall, and can even use the symbol engine to report the names of functions.

I wouldn’t need symbols if the trace identified a device driver, so I ran Kernrate without passing it any arguments. Despite the fact that there’s no officially supported version of Kernrate for Vista, the version for Windows XP, Kernrate_i386_XP.exe, works on Vista 32-bit (you can also use the recently-released xperf tool to perform similar profiling - xperf requires Vista or Server 2008, but works on 64-bit versions). I let the profile run through heavy bursts of CPU and then hit Ctrl+C to print the results to the console window:

In first place were hits in the kernel, but in second was a driver that I didn’t recognize, b57nd60x. Most driver files are located in the %systemroot%system32drivers directory, so I could have opened that folder and viewed the file’s properties in Explorer, but I had Process Explorer open so a quicker way to check the driver’s vendor and version was to open the DLL view for the System process. The DLL view shows the DLLs and files mapped into the address space of user-mode processes, but for the System process it shows the kernel modules, including drivers, loaded on the system. The DLL view revealed that the driver was for my laptop’s NIC, was from Broadcom, and was version 10.10:

Now that I knew that the Broadcom driver was causing the CPU usage, the next step was to see if there was a newer version available. I went to Dell’s download page for my system, but didn’t find anything. Suspecting that what I noticed might not be a known issue, I decided to notify Broadcom. I used contacts on the hardware ecosystem team here at Microsoft to find the Broadcom driver representative and email him a detailed description of the symptoms and my investigation. He forwarded my email to the driver developer, who acknowledged that they didn’t know the cause and within a few days sent me a debug version of the driver with symbols so that I could capture a Kernrate profile that would tell them what functions in the driver were active during the spikes. The problem reoccurred a few days later and I sent back the kernrate output with function information.

The developer explained that my trace revealed that the driver didn’t efficiently interact with the PCIe bus when processing specific queries and the problem seemed to be exacerbated by my particular hardware configuration. He gave me new driver for me to try and after a few weeks of monitoring my laptop closely for issues, I confirmed that the problem appeared to be resolved. The updated driver has not yet been posted to Dell’s support site, but I expect it to show up there in the near future. Another case closed, this time with Process Explorer, Kernrate, and a helpful Broadcom driver developer.

If you like these troubleshooting blog posts, you’ll enjoy the webcast of my “Case of the Unexplained…” session from TechEd/ITforum. Its 75 minutes are packed with real-world troubleshooting examples, including the one written up in this post and others, as well as some that I haven’t documented. At the end of the session I ask the audience to send me screenshots, log files and descriptions of their own troubleshooting success stories, in return for which I’ll send back a signed copy of Windows Internals. The offer stands, so remember to document your investigation and you can get a free book. I’ve gotten a number of great examples and my next blog post will be a guest post by someone that watched the webcast and used Process Monitor to solve a problem with their web server.

Finally, if you want to see me speak live, come to TechEd US/IT Pro in June in Orlando where I’ll be delivering “The Case of the Unexplained…”, “Windows Server 2008 Kernel Advances”, and “Windows Security Boundaries”. Hope to see you there!