Chapter 14 · Device Manager

Knowledge Check

9 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What does Device Manager really show you: a list of hardware, or something else?
  2. What is the name of the file you type in Win + R to open Device Manager?
  3. What is enumeration, and who does it?
  4. In the ID USB\VID_046D&PID_C52B, what do VID and PID stand for?
  5. Which wins when ranking drivers: a hardware ID match or a compatible ID match?
  6. What does the Roll Back Driver button do?
  7. What command shows non-present (ghost) devices in Device Manager?
  8. What do Code 22 and Code 28 mean?
  9. What does a negative IRQ number in Device Manager tell you?
  10. Which Properties tab lets you read the Class GUID and device instance path?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. What Device Manager shows

It shows the PnP device tree that the Plug and Play manager keeps in the kernel. It is a viewer and editor of that tree, not the thing that finds or runs devices.

2. The file name

devmgmt.msc.

3. Enumeration

The "roll call": a bus driver (PCI, USB, ACPI or root) finds the devices on its bus and reports them to the PnP manager, which makes a node for each.

4. VID and PID

Vendor ID (the company) and Product ID (the product from that company).

5. Ranking

A hardware ID match beats a compatible ID match.

6. Roll Back Driver

It returns the device to the previous driver it used (one step back only).

7. Showing ghost devices

In a Command Prompt: set devmgr_show_nonpresent_devices=1, then devmgmt.msc, then View → Show hidden devices.

8. Codes 22 and 28

Code 22: the device is disabled. Code 28: the drivers for the device are not installed.

9. Negative IRQ

The device uses MSI or MSI-X (message-signalled interrupts). It is normal and healthy.

10. The Details tab

The Details tab, using its Property drop-down list.

UNDERSTANDING QUESTIONS

Q1. Why does the "Devices by connection" view show you things that "Devices by type" hides?

Answer Both views draw the same tree, but by type groups devices by what they are, so the parent-child links are lost. By connection keeps the real structure: root, buses, controllers, hubs, devices. It helps you see that a USB mouse depends on its hub and controller, so a fault higher up affects everything below.

Q2. Why can a brand-new USB mouse work at once, even if Windows has never seen that model?

Answer The mouse also reports a compatible ID that says "I follow the standard HID mouse class." Windows has a built-in generic driver for that class, so it uses it. A hardware ID match for the exact model would give extra features, but the compatible match is enough for basic use.

Q3. A newer, higher-version generic driver is available, yet Windows keeps the older maker driver. Why?

Answer Ranking looks first at **how the IDs matched**. The maker driver matches by hardware ID, the generic one by compatible ID. The hardware ID match is better, so the date and version are never compared. Signature, date and version only decide between drivers with the same rank.

Q4. Why does the DMA list in "Resources by type" look nearly empty on a modern PC, even though SSDs and network cards use DMA?

Answer Old ISA DMA used a few numbered channels handed out by the chipset. Modern devices use bus-master DMA: they read and write RAM themselves using addresses the driver gives them. There is no channel number to list, so the DMA list stays short.

Q5. Why does uninstalling a device often "fix" a problem, and why might it come back with the same problem?

Answer Uninstalling removes the node and its stored settings, so after a rescan or restart Windows builds a fresh node. That clears bad settings. But if you did not tick "delete the driver", the same driver stays in the Driver Store and is used again. If the driver itself is the problem, the fault returns.

SCENARIO QUESTIONS (Troubleshooting)

S1. You plug in a new gadget and Device Manager shows "Unknown device" with a yellow triangle and Code 28. What do you do?

Answer Code 28 means no driver is installed. Open the device's Details tab, read the Hardware Ids, and search for the vendor and device codes to find the maker. Download the driver from the maker (or the PC maker) and install it with their setup program or with Update driver, then Browse my computer. Do not use random driver-updater programs.

S2. After a graphics driver update, the screen flickers. What is the quickest safe step?

Answer Open the graphics device's Properties, Driver tab, and click Roll Back Driver. That returns to the previous driver. If the button is grey, install an earlier driver from the maker's website. Then check the maker's notes for a fixed release before updating again.

S3. A USB drive shows Code 43. What do you try?

Answer Plug it straight into the PC (no hub), try a different port and cable, restart, and test the drive on another PC. If it fails there too, the drive is faulty. If it works elsewhere, update or roll back the USB drivers on your PC, and check power settings and the chipset driver.

S4. A tutorial tells you to "look for the red X" to find a disabled device, but you see a small down arrow. Is something wrong?

Answer Nothing is wrong. Older Windows versions used a red X for a disabled device. On Windows 10 and 11 the down arrow is used. Right-click the device and choose Enable device (Code 22 means disabled).

S5. You cannot find your old USB printer in Device Manager, but you know it was installed before. How do you see it?

Answer It is probably a non-present (ghost) device. Open a Command Prompt, run `set devmgr_show_nonpresent_devices=1`, then `devmgmt.msc`, and choose View → Show hidden devices. Greyed entries are devices remembered but not connected. You can also run `pnputil /enum-devices` and read the full list.

INTERVIEW QUESTIONS

I1. Explain what Device Manager is and what it is not.

Answer It is an MMC snap-in (devmgmt.msc) that displays and edits the PnP device tree maintained by the kernel's Plug and Play manager. It does not detect hardware, choose drivers or run devices. Bus drivers enumerate devices, the PnP manager matches drivers, and Device Manager sends requests such as update, disable or uninstall.

I2. Describe how Windows chooses a driver for a device.

Answer The bus driver reports the device's hardware IDs and compatible IDs. The PnP manager searches the Driver Store (and Windows Update when allowed) for INF files that list matching IDs. Candidates are ranked: ID match first (hardware beats compatible, earlier beats later), then signature, then newer date, then higher version. The best candidate is installed and started.

I3. What is the difference between a hardware ID and a compatible ID?

Answer A hardware ID names the exact model and revision (for example PCI VEN, DEV, SUBSYS, REV or USB VID, PID). A compatible ID names a general class or standard the device follows, so a generic driver can run it. Hardware ID matches rank better; compatible IDs are the fallback.

I4. What is the difference between disabling a device and uninstalling it?

Answer Disable stops the driver and frees the resources but keeps the node, settings and driver (shown with a down arrow, Code 22). Uninstall removes the node and settings, and optionally the driver package. An uninstalled device that is still connected can return after a rescan or restart.

I5. How would you diagnose a device with Code 10?

Answer Read the full status text, try another port and cable, check power, then update or roll back the driver. Look at the device's Events tab and Event Viewer (System log, Kernel-PnP) for details around the time of failure, and test on another PC to separate hardware from software faults.

PRACTICAL TASK

Make a one-page "ID card" for one device in your PC. Choose a device (for example your network adapter). In Device Manager, collect: its name, class, Hardware Ids (first two lines), Compatible Ids, device instance path, Class GUID, driver provider, version, date and signer, and one resource (an IRQ or memory range). Then run pnputil /enum-devices /connected or Get-PnpDevice -PresentOnly and find the same device. Write what is the same and what is different in the two views.

Why This Matters

When a device fails, support teams ask for exactly these facts. Knowing where to find them (and what each means) lets you search for the right driver, explain the problem clearly, and tell a hardware fault from a driver fault.

CHAPTER SUMMARY

  • Device Manager is a viewer and editor of the PnP device tree; the PnP manager does the real work.
  • Enumeration: bus drivers (root, ACPI, PCI, USB) find devices and report them. The tree runs bus, device, function.
  • IDs: a hardware ID names the exact model; compatible IDs name a standard. Hardware ID matches rank better.
  • Driver selection: Driver Store, then Windows Update, then ranking by ID match, signature, date and version.
  • Actions: update, roll back, disable, uninstall, scan for hardware changes. Disabling keeps everything; uninstalling removes the node.
  • Hidden, disabled and ghost devices differ; set devmgr_show_nonpresent_devices=1 shows non-present ones.
  • Status: yellow triangle (problem), down arrow (disabled); key codes 10, 22, 28, 43, 45, 52.
  • Resources: IRQ (negative = MSI), I/O ranges, memory ranges, and rarely DMA channels; conflicts are rare today.
  • Properties tabs: General, Driver, Details, Events, Resources, Power Management.