Section 5: Driver Installation

The Big Picture: A Recipe, a Pantry and a Cook

Installing a driver is not just "copy a file." Windows needs to know which device the driver is for, where to put the files, what registry entries to make, and whether the package is trustworthy. All of this is written in a small instruction file, kept together with the driver files in a package, and stored in a safe place called the Driver Store.

Think of it as cooking: the INF file is the recipe, the package is the box of ingredients, the Driver Store is the pantry, and the PnP Manager (Section 7) is the cook who decides when to use them.

5.1 INF Files (Installation Instructions)

What it is: An INF file is a plain text file (extension .inf) that tells Windows how to install a driver. You can open it in Notepad. It looks like an old-style settings file, with [Sections] and key = value lines.

What an INF describes:

A tiny made-up fragment, just to show the look (not a working driver):

[Version]
Signature   = "$WINDOWS NT$"
Class       = Net
Provider    = %Maker%
CatalogFile = mydriver.cat
DriverVer   = 01/15/2025,1.2.3.4
 
[Manufacturer]
%Maker% = ModelsSection, NTamd64
 
[ModelsSection]
%DeviceName% = Install, PCI\VEN_1234&DEV_5678
 
[Strings]
Maker      = "Example Maker"
DeviceName = "Example Network Adapter"

The line under [ModelsSection] says: "If a device shows up with the hardware ID PCI\VEN_1234&DEV_5678, use the Install instructions." That is the link between a physical device and its driver.

Where INFs live: Windows' own are in C:\Windows\INF. Third-party drivers are renamed to oem0.inf, oem1.inf, and so on, when added to the system (see 5.3).

5.2 Driver Packages (Catalog + INF + Binaries)

What it is: A driver package is a folder with everything needed to install one driver. A typical package has three kinds of file:

The catalog (.cat) file in plain words: For each file, a catalog stores a hash: a short fingerprint calculated from the file's contents. Change even one byte and the fingerprint changes. The catalog itself is signed by the maker (or by Microsoft). When Windows installs the package, it recalculates each file's fingerprint and compares it with the signed list. If anything was altered, the check fails. This is the heart of driver signing (Section 8).

   DRIVER PACKAGE (a folder)
   ┌───────────────┐  ┌───────────────┐  ┌───────────────┐
   │ mydriver.inf  │  │ mydriver.sys  │  │ mydriver.cat  │
   │ instructions  │  │ the code      │  │ signed hashes │
   └───────────────┘  └───────────────┘  └───────────────┘

Many makers also supply an installer (setup.exe) around the package. That installer may add extra programs (a control panel app), but under the hood it adds the same INF-based package to Windows.

5.3 The Driver Store (C:\Windows\System32\DriverStore)

What it is: The Driver Store is Windows' own protected library of driver packages. Its real files are in:

C:\Windows\System32\DriverStore\FileRepository

Inside, every package gets its own folder, named after the INF plus a unique tag, such as netrtwlane.inf_amd64_3f9c2a1b.... Each folder holds that package's INF, SYS and CAT files.

Why a separate store?

Where does the running copy go? When a driver is installed for a device, Windows normally copies the .sys file to C:\Windows\System32\drivers and writes registry entries (the driver's service key, Section 6). (Some newer drivers run directly from the Driver Store folder; this is allowed.) The INF is also copied to C:\Windows\INF under an oem<number>.inf name.

  Package ──► DRIVER STORE  (the pantry:  System32\DriverStore\FileRepository)
                  │
                  │  when a matching device appears
                  ▼
        INSTALLED: .sys in System32\drivers  +  registry service key
                  │
                  ▼
              Driver loads (Section 6)

Useful read-only commands (they only show information):

pnputil /enum-drivers

This lists every package in the Driver Store: its published name (oem12.inf), the original INF name, the provider, the class and the version/date. (On Windows 10 version 1607 and newer, pnputil uses /enum-drivers; older versions used -e.)

You can also look at the folder in File Explorer (it is readable, but do not delete things in it). A real PC often has hundreds of packages, and the store can take a few gigabytes.

Adding and removing (for knowledge only, not for the lab):

Those need an administrator command prompt. Removing the wrong package can break a device. This chapter's lab does not use them.

5.4 Staging vs Installing a Driver

What it is: These are two different steps that people often mix up.

Why have two steps? Imagine you are preparing a laptop for a company. You can stage the printer driver for 200 laptops in advance. Later, any standard user can plug in the printer, and Windows installs it from the store, with no admin password needed.

  1. STAGE  (needs admin once)          2. INSTALL  (when device appears)
  package ──► checked ──► Driver Store      Driver Store ──► device bound,
                                                             files + registry,
                                                             driver starts

When does Windows pick a driver? Whenever a device is found, the PnP Manager searches: first the Driver Store, and then (if allowed) Windows Update. Section 7 explains how it matches and ranks drivers.

Updating and rolling back. A new version of a driver is staged next to the old one. If it misbehaves, Device Manager → Properties → Driver → Roll Back Driver switches back to the previous one, because the old package is still in the store.

Windows tip: In Device Manager, open a device → Properties → Driver tab. You will see Driver Provider, Driver Date, Driver Version, Digital Signer, and buttons for details, update, roll back, disable and uninstall.

Summary