Chapter 13 · Device Drivers

Practical Lab: Driver Exploration

7 min read

Objective

Find out which drivers run on your own PC, where they live, who signed them and how your devices are connected. You only look. Nothing in this lab installs, removes, disables or changes any driver.

Time: 25–30 minutes
You need: A Windows 10 or 11 PC. No extra software is required. (One free optional tool is named in Part 6.)

What to Open

ToolHow to open it
Device ManagerPress Win + X, then choose Device Manager
PowerShellPress Win, type PowerShell, press Enter (normal, not admin)
Command PromptPress Win, type cmd, press Enter
System InformationPress Win + R, type msinfo32, press Enter
Registry Editor (look only)Press Win + R, type regedit, press Enter

Safety rule: In Device Manager, only open Properties. Do not click Uninstall device, Disable device, Update driver or Roll Back Driver. In regedit, do not edit, add or delete anything.

Part 1: Who Is Running Windows? (winver)

Press Win + R, type winver, press Enter.

  1. Windows version and build: ________________

(Many of the commands below need Windows 10 version 1607 or newer for pnputil /enum-....)

Part 2: The Device Tree and One Driver in Detail (Device Manager)

2A. See the tree. Choose View → Devices by connection. Open ACPI x64-based PC → Microsoft ACPI-Compliant System → PCI Express Root Complex. This is the device tree from Section 7.

  1. Find a USB Root Hub or USB xHCI Host Controller line. What is its parent in the tree? ________________

2B. Inspect one device. Switch back to View → Devices by type. Open Keyboards, double-click your keyboard, and look at the Driver tab:

  1. Driver Provider: ________________
  2. Driver Date and Version: ________________
  3. Digital Signer: ________________

Click Driver Details (only look, then close). It lists the driver files:

  1. Which .sys files are listed? (for example kbdclass.sys, i8042prt.sys or kbdhid.sys) ________________

2C. Read the IDs. Go to the Details tab. Use the Property drop-down:

  1. Hardware Ids: ________________
  2. Compatible Ids: ________________
  3. Device instance path: ________________

If your keyboard is USB, the hardware ID will look like USB\VID_xxxx&PID_xxxx or HID\VID_xxxx&PID_xxxx (Section 7.3). A laptop's built-in keyboard may be an older PS/2 type (ACPI\...).

2D. See the stack parent. Back in the Devices by connection view, find your keyboard. (A USB keyboard appears as HID Keyboard Device under a USB Input Device under a USB hub.)

  1. How many levels is it below the PCI Express Root Complex? ________________

Part 3: List All Drivers (driverquery)

In Command Prompt:

driverquery
  1. How many lines are listed (roughly)? ________________

Now the detailed version, saved to a file so it's easy to read:

driverquery /v /fo csv > "%USERPROFILE%\Desktop\drivers.csv"

Open drivers.csv on your Desktop with Excel (or Notepad). Look at the columns Module Name, Display Name, Driver Type, Start Mode, State, Path.

  1. What are the possible Start Mode values you see? (Boot, System, Auto, Manual, Disabled; compare with Section 6.3) ________________
  2. Find disk and kbdclass. What is each one's Start Mode? ________________
  3. How many drivers have State = Stopped? (Not every installed driver is running.) ________________

Check the signing state:

driverquery /si
  1. Are there any lines with IsSigned = FALSE? ________________ (Usually none or very few on a normal PC.)

Delete drivers.csv from your Desktop when you are done.

Part 4: The Driver Store and Driver Files

4A. Files on disk. In File Explorer, open:

C:\Windows\System32\drivers
  1. Roughly how many .sys files are there? ________________
  2. Find disk.sys, kbdclass.sys and ntfs.sys. Right-click one → Properties → Details. Who is the Copyright / Company? ________________

4B. The Driver Store. In PowerShell or Command Prompt:

pnputil /enum-drivers

Look at a few entries. Each shows:

Published Name:     oem12.inf
Original Name:      netrtwlane.inf
Provider Name:      Realtek Semiconductor Corp.
Class Name:         Network adapters
Driver Version:     01/15/2024 1.2.3.4
Signer Name:        Microsoft Windows Hardware Compatibility Publisher

(Yours will differ.)

  1. How many different Provider Names can you see? ________________
  2. What is the most common Signer Name? ________________

Now peek at the folder (look only; do not delete or rename anything):

C:\Windows\System32\DriverStore\FileRepository
  1. Open one folder. Which three kinds of file (INF, SYS, CAT) can you find? ________________

Part 5: Devices, Problems and Signed Drivers (PowerShell)

Get-PnpDevice -PresentOnly | Select-Object -First 15 Status, Class, FriendlyName
  1. Do all devices say OK? ________________

Show only devices with a problem (probably none):

Get-PnpDevice -PresentOnly | Where-Object Status -ne 'OK' | Select-Object Status, Class, FriendlyName
pnputil /enum-devices /problem
  1. Any devices listed with a problem? ________________

Now the signed driver information:

Get-CimInstance Win32_PnPSignedDriver |
  Where-Object DeviceClass -eq 'KEYBOARD' |
  Select-Object DeviceName, DriverProviderName, DriverVersion, DriverDate, Signer, IsSigned, InfName
  1. What is the InfName? (For a USB keyboard you might see keyboard.inf.) ________________

For your disk and network devices:

Get-CimInstance Win32_PnPSignedDriver |
  Where-Object { $_.DeviceClass -in 'DISKDRIVE','NET' } |
  Select-Object DeviceName, DriverProviderName, DriverVersion, Signer
  1. Which company wrote your network driver? ________________

Part 6: Services Key, System Drivers and Filters

6A. The registry (view only). In regedit, go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass
  1. Start value: ________ Type value: ________ ImagePath (if any): ________________

(Compare with Section 6: Type = 1 is a kernel driver. Start = 3 means demand start; Start = 1 means system start.)

Close Registry Editor without changing anything.

6B. System drivers in msinfo32. In msinfo32 open Software Environment → System Drivers. Click the Started column heading to sort.

  1. Find any driver whose Start Mode is Boot. What does it do? (Section 6.3: usually storage.) ________________

6C. Filter drivers. Open Command Prompt as administrator (right-click → Run as administrator) and type:

fltmc
  1. How many filters are listed? ________________
  2. Which one belongs to Microsoft Defender (WdFilter)? What is its altitude? ________________

(If you do not want to use an administrator prompt, skip this step.)

6D. Optional free tool. Download WinObj only from Microsoft's official Sysinternals site. Run it, open \GLOBAL?? and find C:.

  1. Which \Device\HarddiskVolumeN does C: point to? ________________

What Should Happen

  • Part 2 shows that a keyboard is really a small stack of drivers with IDs.
  • Part 3 shows dozens or hundreds of drivers, mostly demand-start or system-start, and almost all signed.
  • Part 4 shows the .sys files in System32\drivers and the packages in the Driver Store.
  • Part 5 shows that nearly every device has a status of OK and a signed driver.
  • Part 6 shows the registry keys, start types and filters behind it all.

Interpretation Guide

What you seeWhat it means
Hardware ID starts with USB\VID_A USB device; VID = maker, PID = product (Section 7.3)
Compatible ID like USB\Class_03HID class; Windows can use a generic Microsoft driver
Digital Signer: Microsoft Windows Hardware Compatibility PublisherDriver passed or was submitted through Microsoft's signing programme (Section 8)
Start Mode = BootNeeded before Windows can reach its disk (Section 6.3)
State = Stopped for a demand-start driverNormal. It starts only when needed
IsSigned = FALSEUnusual; investigate. Could be an old or test driver
Device Status = Error / UnknownMissing or failing driver; see Section 14 and the Device Manager error code
oemNN.inf in pnputilA third-party driver package in the Driver Store (Section 5.3)
WdFilter in fltmcMicrosoft Defender's file system filter (Section 13.2)

Not part of this lab (on purpose): Disabling and re-enabling a device, installing or deleting drivers, turning on Driver Verifier. Those can change how your PC behaves, and Verifier can make a PC unbootable (Section 14.3). Try such things only on a test machine or a virtual machine.

Follow-Up Questions

  1. In Part 2, why does the same keyboard appear as two entries (USB Input Device and HID Keyboard Device)?
  2. Why does disk.sys have Start Mode = Boot while a Bluetooth driver does not?
  3. Pick one driver from driverquery /v. What would happen if it crashed? Is it a kernel-mode or user-mode driver? (Hint: look for WUDFHost.exe in Task Manager.)
  4. Why is a driver in the Driver Store not always a driver that is running?
  5. Name three facts from this lab that you could not have learned by looking at the outside of the PC.