Devcon Examples
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
Devcon Examples
Display operations
hwids
classes
listclass
driverfiles
drivernodes
resources
stack
status
hwids
The hwids operation displays the hardware IDs, compatible IDs, and instance IDs of devices on the system.
Example 1: Find all hardware IDs
Because Devcon operations use IDs and ID patterns to identify devices, a common first step in using Devcon is to create a hardware ID reference file for devices on the computer.
The following command uses the hwids operation, which returns the IDs and the device description. It uses the wildcard character (*) to represent all devices on the local computer.
devcon hwids *
Because the output is lengthy and used repeatedly, save the output in a text file for reference.
The following command uses the wildcard character (*) in the hwids operation command to represent all devices on the computer. It uses the redirection character (>) to save the command output in the hwids.txt file.
devcon hwids * > hwids.txt
The following command finds the hardware IDs of devices on a remote computer, Server01. It uses the /m parameter to specify the name of the remote computer. The command redirects the output to the server01_hwids.txt file for later reference.
Note
- This command fails unless the user has the required permissions on the remote computer.
devcon /m:\\server01 hwids * > server01_hwids.txt
Example 2: Find hardware IDs by using a pattern
To find the hardware IDs of a particular device, you must enter the hardware ID or pattern, the compatible ID or pattern, the instance ID or pattern, or the name of the device setup class.
The following command uses a pattern to find the actual hardware ID of the floppy disk drive on the computer. (The user assumes that the pattern appears in the one of the device identifiers.) The command uses the wildcard character (*) to represent all characters that might precede or follow the word, "floppy," in any of the IDs.
devcon hwids *floppy*
In response, Devcon displays the instance ID, hardware ID and compatible ID of the floppy disk drive on the computer. These IDs can be used in subsequent Devcon commands.
FDC\GENERIC_FLOPPY_DRIVE\5&39194F6D&0&0
Name: Floppy disk drive
Hardware ID's:
FDC\GENERIC_FLOPPY_DRIVE
Compatible ID's:
GenFloppyDisk
1 matching device(s) found.
In this case, the phrase "floppy" occurs in the hardware ID or compatible ID of only one device on the computer. If it occurs in the ID of more than one device, all devices with "floppy" in their IDs appear in the output.
Example 3: Find hardware IDs by using a class
The following command uses a device setup class to find the hardware IDs of all devices in the Ports device setup class. The equal sign (=) preceding the class name indicates that it is a class, not an ID.
devcon hwids =ports
In response, Devcon displays the hardware ID and compatible ID of all three devices in the Ports setup class.
ACPI\PNP0401\4&B4063F4&0
Name: ECP Printer Port (LPT1)
Hardware ID's:
ACPI\PNP0401
*PNP0401
ACPI\PNP0501\1
Name: Communications Port (COM1)
Hardware ID's:
ACPI\PNP0501
*PNP0501
ACPI\PNP0501\2
Name: Communications Port (COM2)
Hardware ID's:
ACPI\PNP0501
*PNP0501
3 matching device(s) found.
classes
The classes operation lists the device setup class of devices in the system.
Example 4: List classes on the local computer
Because Devcon operations can use the device setup class to identify devices, it is useful to create a reference file of the device setup classes of devices on the computer.
The following command uses classes operation, which returns a list and description of all classes on the computer. The classes operation does not take parameter arguments that specify a device. It only lists all classes on the computer.
devcon classes
Because the output is lengthy and used repeatedly, save the output in a text file for reference.
The following command displays all device classes on the computer. It uses the redirection character (>) to save the command output in the classes.txt file.
devcon classes > classes.txt
Example 5: List classes on the remote computer
The following command lists the device setup classes on a remote computer, Server01
devcon /m:\\server01 classes
Because the output is lengthy and used repeatedly, save the output in a text file for reference.
The following command uses the redirection character (>) to save the command output in the server01_classes.txt file.
devcon /m:\\server01 classes > server01_classes.txt
listclass
The listclasses operation lists the devices in a device setup class.
Example 6: List the devices in a device setup class
The following command lists the devices in Net, the device setup class for network adapters. This command is usually preceded by a command to list all of the classes on the computer (devcon classes), to get the correct name of the setup class.
devcon listclass net
In response, Devcon displays the instance ID and description of each device in the Net setup class.
Listing 6 device(s) for setup class "Net" (Network adapters).
PCI\VEN_10B7&DEV_9200&SUBSYS_00BE1028&REV_78\4&BB7B4AE&0&60F0: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
ROOT\MS_L2TPMINIPORT\0000 : WAN Miniport (L2TP)
ROOT\MS_NDISWANIP\0000 : WAN Miniport (IP)
ROOT\MS_PPPOEMINIPORT\0000 : WAN Miniport (PPPOE)
ROOT\MS_PPTPMINIPORT\0000 : WAN Miniport (PPTP)
ROOT\MS_PTIMINIPORT\0000 : Direct Parallel
This display, while interesting, does not provide the hardware IDs of the devices in the Net setup class. The following command uses the Devcon Syntax operation to list the devices in the Net setup class. In the hwids operation, the class name is preceded by an equal sign (=) to indicate that it is a class, not an ID.
devcon hwids =net
The resulting display lists the devices in the Net class and includes the instance ID, hardware IDs and compatible IDs of devices in the class.
PCI\VEN_10B7&DEV_9200&SUBSYS_00BE1028&REV_78\4&BB7B4AE&0&60F0
Name: 3Com 3C920 Integrated Fast Ethernet Controller (3C905C-TX Compatible)
Hardware ID's:
PCI\VEN_10B7&DEV_9200&SUBSYS_00BE1028&REV_78
PCI\VEN_10B7&DEV_9200&SUBSYS_00BE1028
PCI\VEN_10B7&DEV_9200&CC_020000
PCI\VEN_10B7&DEV_9200&CC_0200
Compatible ID's:
PCI\VEN_10B7&DEV_9200&REV_78
PCI\VEN_10B7&DEV_9200
PCI\VEN_10B7&CC_020000
PCI\VEN_10B7&CC_0200
PCI\VEN_10B7
PCI\CC_020000
PCI\CC_0200
ROOT\MS_L2TPMINIPORT\0000
Name: WAN Miniport (L2TP)
Hardware ID's:
ms_l2tpminiport
ROOT\MS_NDISWANIP\0000
Name: WAN Miniport (IP)
Hardware ID's:
ms_ndiswanip
ROOT\MS_PPPOEMINIPORT\0000
Name: WAN Miniport (PPPOE)
Hardware ID's:
ms_pppoeminiport
ROOT\MS_PPTPMINIPORT\0000
Name: WAN Miniport (PPTP)
Hardware ID's:
ms_pptpminiport
ROOT\MS_PTIMINIPORT\0000
Name: Direct Parallel
Hardware ID's:
ms_ptiminiport
6 matching device(s) found.
Example 7: List the devices in a multiples classes on a remote computer
The following command lists the devices in the DiskDrive, CDROM, and TapeDrive classes on Server01, a remote computer.
devcon /m:\\server01 listclass diskdrive cdrom tapedrive
In response, Devcon displays the devices in those classes on the remote computer.
Listing 1 device(s) for setup class "DiskDrive" (Disk drives) on \\server01.
IDE\DISKWDC_WD204BA_____________________________16.13M16\4457572D414D3730323136333938203120202020: WDC WD204BA
Listing 1 device(s) for setup class "CDROM" (DVD/CD-ROM drives) on \\server01.
IDE\CDROMSAMSUNG_DVD-ROM_SD-608__________________2.2_____\4&13B4AFD&0&0.0.0: SAMSUNG DVD-ROM SD-608
No devices for setup class "TapeDrive" (Tape drives) on \\server01.
driverfiles
The driverfiles operation lists the file names of device drivers used by devices on the system.
Example 8: List all driver files
The following command lists the file names of drivers used by devices on the system. The command uses the wildcard character (*) to indicate all devices on the system. Because the output is extensive, the command uses the redirection character (>) to redirect the output to a reference file, driverfiles.txt.
devcon driverfiles * > driverfiles.txt
Example 9: List the driver files of a particular device.
The following command searches for the device driver used by the mouse device on the local computer. It identifies the device by one of its hardware IDs, HID\Vid_045e&Pid_0039&Rev_0121. (To find the hardware ID of a device, use the Devcon Syntax operation.) The hardware ID is enclosed in quotation marks because it includes the ampersand character (&).
devcon driverfiles "HID\Vid_045e&Pid_0039&Rev_0121"
In response, Devcon displays the two device drivers that support the mouse device.
HID\VID_045E&PID_0039\6&DC36FDE&0&0000
Name: Microsoft USB IntelliMouse Optical
Driver installed from c:\windows\inf\msmouse.inf [HID_Mouse_Inst]. 2 file(s)
used by driver:
C:\WINDOWS\System32\DRIVERS\mouhid.sys
C:\WINDOWS\System32\DRIVERS\mouclass.sys
1 matching device(s) found.
drivernodes
The drivernodes operation lists all driver packages that are compatible with the device, along with their version and ranking. Valid only on the local computer.
Example 10: List driver packages by hardware ID pattern
The following command lists the driver nodes of all devices whose hardware ID begins with "sw" (software devices). Patterns are useful for finding information about similar devices that might not be in the same setup class.
The drivernodes operation is particularly useful for troubleshooting setup problems. For example, you can use the drivernodes operation to find out whether an INF file included in Windows was used for a device instead of a customized third-party INF file.
devcon drivernodes sw*
In response, Devcon displays the driver nodes of devices whose hardware IDs or compatible IDs begin with "sw."
SW\{A7C7A5B0-5AF3-11D1-9CED-00A024BF0407}\{9B365890-165F-11D0-A195-0020AFD156E4}
Name: Microsoft Kernel System Audio Device
DriverNode #0:
Inf file is c:\windows\inf\wdmaudio.inf
Inf section is WDM_SYSAUDIO
Driver description is Microsoft Kernel System Audio Device
Manufacturer name is Microsoft
Provider name is Microsoft
Driver date is 7/1/2001
Driver version is 5.1.2535.0
Driver node rank is 0
Driver node flags are 00002244
Inf is digitally signed
SW\{B7EAFDC0-A680-11D0-96D8-00AA0051E51D}\{9B365890-165F-11D0-A195-0020AFD156E4}
Name: Microsoft Kernel Wave Audio Mixer
DriverNode #0:
Inf file is c:\windows\inf\wdmaudio.inf
Inf section is WDM_KMIXER
Driver description is Microsoft Kernel Wave Audio Mixer
Manufacturer name is Microsoft
Provider name is Microsoft
Driver date is 7/1/2001
Driver version is 5.1.2535.0
Driver node rank is 0
Driver node flags are 00002244
Inf is digitally signed
SW\{CD171DE3-69E5-11D2-B56D-0000F8754380}\{9B365890-165F-11D0-A195-0020AFD156E4}
Name: Microsoft WINMM WDM Audio Compatibility Driver
DriverNode #0:
Inf file is c:\windows\inf\wdmaudio.inf
Inf section is WDM_WDMAUD
Driver description is Microsoft WINMM WDM Audio Compatibility Driver
Manufacturer name is Microsoft
Provider name is Microsoft
Driver date is 7/1/2001
Driver version is 5.1.2535.0
Driver node rank is 0
Driver node flags are 00002244
Inf is digitally signed
3 matching device(s) found.
Example 11: List driver packages by instance ID pattern
The following command lists the driver nodes of all devices whose instance IDs begin with ROOT\MEDIA, that is, devices in the Enum\Root\Media registry subkey. The command uses the at character (@) to indicate that the phrase is in the instance ID.
**devcon drivernodes @ROOT\\MEDIA\***
In response, Devcon displays the driver nodes of devices whose instance ID begins with "ROOT\MEDIA"
ROOT\MEDIA\MS_MMACM
Name: Audio Codecs
DriverNode #0:
Inf file is c:\windows\inf\wave.inf
Inf section is MS_MMACM
Driver description is Audio Codecs
Manufacturer name is (Standard system devices)
Provider name is Microsoft
Driver date is 7/1/2001
Driver version is 5.1.2535.0
Driver node rank is 0
Driver node flags are 00002240
Inf is digitally signed
ROOT\MEDIA\MS_MMDRV
Name: Legacy Audio Drivers
DriverNode #0:
Inf file is c:\windows\inf\wave.inf
Inf section is MS_MMDRV
Driver description is Legacy Audio Drivers
Manufacturer name is (Standard system devices)
Provider name is Microsoft
Driver date is 7/1/2001
Driver version is 5.1.2535.0
Driver node rank is 0
Driver node flags are 00002240
Inf is digitally signed
ROOT\MEDIA\MS_MMMCI
Name: Media Control Devices
DriverNode #0:
Inf file is c:\windows\inf\wave.inf
Inf section is MS_MMMCI
Driver description is Media Control Devices
Manufacturer name is (Standard system devices)
Provider name is Microsoft
Driver date is 7/1/2001
Driver version is 5.1.2535.0
Driver node rank is 0
Driver node flags are 00002240
Inf is digitally signed
ROOT\MEDIA\MS_MMVCD
Name: Legacy Video Capture Devices
DriverNode #0:
Inf file is c:\windows\inf\wave.inf
Inf section is MS_MMVCD
Driver description is Legacy Video Capture Devices
Manufacturer name is (Standard system devices)
Provider name is Microsoft
Driver date is 7/1/2001
Driver version is 5.1.2535.0
Driver node rank is 0
Driver node flags are 00002240
Inf is digitally signed
ROOT\MEDIA\MS_MMVID
Name: Video Codecs
DriverNode #0:
Inf file is c:\windows\inf\wave.inf
Inf section is MS_MMVID
Driver description is Video Codecs
Manufacturer name is (Standard system devices)
Provider name is Microsoft
Driver date is 7/1/2001
Driver version is 5.1.2535.0
Driver node rank is 0
Driver node flags are 00002240
Inf is digitally signed
5 matching device(s) found.
resources
The resources operation lists the resources allocated to each device in the system.
Example 12: List resources of a class of devices
The following command displays the resources allocated to devices in the hdc class. This class includes IDE controllers. The equal sign (=) is prepended to "hdc" to indicate that it is a class and not an ID.
devcon resources =hdc
In response, Devcon lists the resources allocated to IDE controllers on the local computer.
PCI\VEN_8086&DEV_244B&SUBSYS_00000000&REV_02\3&29E81982&0&F9
Name: Intel(r) 82801BA Bus Master IDE Controller
Device is currently using the following resources:
IO : ffa0-ffaf
PCIIDE\IDECHANNEL\4&37E53584&0&0
Name: Primary IDE Channel
Device is currently using the following resources:
IO : 01f0-01f7
IO : 03f6-03f6
IRQ : 14
PCIIDE\IDECHANNEL\4&37E53584&0&1
Name: Secondary IDE Channel
Device is currently using the following resources:
IO : 0170-0177
IO : 0376-0376
IRQ : 15
3 matching device(s) found.
Example 13: List resources of device on a remote computer by ID
The following command lists the resources allocated to the system timer on Server01, a remote computer. The command uses the hardware ID of the system timer, ACPI\PNP0100, to specify the device.
devcon /m:\\Server01 resources *PNP0100
In response, Devcon displays the resources of the Server01 system timer.
ROOT\*PNP0100\PNPBIOS_8
Name: System timer
Device has the following resources reserved:
IO : 0040-005f
IRQ : 0
1 matching device(s) found on \\server01.
The following command uses the instance ID of the remote system timer in the Devcon resources command. The at character (@) indicates that the string is an instance ID, not a hardware ID or compatible ID.
**devcon /m:\\Server01 resources @ACPI\\PNP0100\\4\&b4063f4&0**
stack
The stack operation displays the expected driver stack for devices on the computer.
Example 14: Display the driver stack for storage devices
The following command searches for devices in the volume setup class and displays the expected driver stack for those devices. The equal sign (=) indicates that the string is a class name.
devcon stack =Volume
In response, Devcon displays the expected stack for the devices. The data returned includes the instance ID and description of each device, the GUID and name of the device setup class, the names of upper and lower filter drivers, and controlling services, if any.
STORAGE\VOLUME\1&30A96598&0&SIGNATURE32323533OFFSET271167600LENGTH6E00D0C00
Name: Generic volume
Setup Class: {71A27CDD-812A-11D0-BEC7-08002BE2092F} Volume
Class upper filters:
VolSnap
Controlling service:
(none)
STORAGE\VOLUME\1&30A96598&0&SIGNATURE32323533OFFSET7E00LENGTH27115F800
Name: Generic volume
Setup Class: {71A27CDD-812A-11D0-BEC7-08002BE2092F} Volume
Class upper filters:
VolSnap
Controlling service:
(none)
2 matching device(s) found.
Example 15: Find the setup class of a device
The stack operation returns the setup class of a device in addition to the upper and lower filter drivers. The following commands find the setup class of the printer port interface by finding its instance ID, and then using the instance ID to find its setup class.
The following command finds the instance ID of the printer port interface by using the Devcon Syntax operation and "LPT," a phrase in the printer port hardware ID.
devcon hwids *lpt*
In response, Devcon returns the instance ID (displayed in bold text), as well as the hardware ID of the printer port interface.
LPTENUM\MICROSOFTRAWPORT\5&CA97D7E&0&LPT1
Name: Printer Port Logical Interface
Hardware ID's:
LPTENUM\MicrosoftRawPort958A
MicrosoftRawPort958A
1 matching device(s) found.
The next command uses the stack operation to find the class of the device represented by the instance ID. An at character (@) identifies the ID as an instance ID. The ID is enclosed in quotation marks because it includes ampersand characters.
devcon stack "@LPTENUM\MICROSOFTRAWPORT\5&CA97D7E&0&LPT1"
In response, Devcon displays the driver stack for the printer port interface, including the class. The display reveals that the printer port is in the System class.
LPTENUM\MICROSOFTRAWPORT\5&CA97D7E&0&LPT1
Name: Printer Port Logical Interface
Setup Class: {4D36E97D-E325-11CE-BFC1-08002BE10318} System
Controlling service:
(none)
1 matching device(s) found.
Example 16: Display the stack for related devices on a remote computer
The following command displays the expected stack for miniport devices on Server01, a remote computer. It searches for devices in the Net setup class that have "miniport" in their hardware ID or compatible ID. Note that this command first limits the search to the Net setup class and then find the "miniport" string. It does not find devices other than those in the Net setup class.
devcon /m:\\server01 stack =net *miniport*
In response, Devcon displays the expected stack for miniports on Server01.
ROOT\MS_L2TPMINIPORT\0000
Name: WAN Miniport (L2TP)
Setup Class: {4D36E972-E325-11CE-BFC1-08002BE10318} Net
Controlling service:
Rasl2tp
ROOT\MS_PPPOEMINIPORT\0000
Name: WAN Miniport (PPPOE)
Setup Class: {4D36E972-E325-11CE-BFC1-08002BE10318} Net
Controlling service:
RasPppoe
Lower filters:
NdisTapi
ROOT\MS_PPTPMINIPORT\0000
Name: WAN Miniport (PPTP)
Setup Class: {4D36E972-E325-11CE-BFC1-08002BE10318} Net
Controlling service:
PptpMiniport
Lower filters:
NdisTapi
ROOT\MS_PTIMINIPORT\0000
Name: Direct Parallel
Setup Class: {4D36E972-E325-11CE-BFC1-08002BE10318} Net
Controlling service:
Raspti
Lower filters:
PtiLink
4 matching device(s) found on \\Server01.
status
The classes operation lists the operational status of devices on the computer.
Example 17: Display the status of all devices on the local computer.
The following command finds the status of all devices on the local computer and saves the status in the status.txt file for logging or later review. The command uses the wildcard character (*) to represent all devices and the redirection character (>) to redirect the output to the status.txt file.
devcon status * > status.txt
Example 18: Display the status of a particular device by instance ID
The most reliable way to find the status of a particular device is to use the instance ID of the device.
The following command uses the instance ID to find the status of the I/O controller on the local computer. The command includes the instance ID of the device, PCI\VEN_8086&DEV_1130&SUBSYS_00000000&REV_02\3&29E81982&0&00. The at character (@) prefixed to the ID identifies the string is an instance ID. The ID must be enclosed in quotation marks because it includes ampersand characters.
devcon status "@PCI\VEN_8086&DEV_1130&SUBSYS_00000000&REV_02\3&29E81982&0&00"
In response, Devcon displays the status of the I/O controller.
PCI\VEN_8086&DEV_1130&SUBSYS_00000000&REV_02\3&29E81982&0&00
Name: Intel(R) 82815 Processor to I/O Controller - 1130
Driver is running.
1 matching device(s) found.
Example 19: Display the status of related devices on a remote computer.
The following command displays the status of particular storage-related devices on Server01, a remote computer. It searches for the following devices:
Disk drive, GenDisk
CD-ROM drive, GenCdRom
Floppy disk drive, FDC\GENERIC_FLOPPY_DRIVE
Volumes, STORAGE\Volume
Logical disk manager, ROOT\DMIO
Volume manager, ROOT\FTDISK
Floppy disk controller, ACPI\PNP0700
In the command, each ID is separated from the others by spaces. Note that GenDisk and GenCdRom are compatible IDs, while the other IDs are hardware IDs.
devcon /m:\\server01 status GenDisk GenCdRom FDC\GENERIC_FLOPPY_DRIVE STORAGE\Volume ROOT\DMIO ROOT\FTDISK ACPI\PNP0700
In response, Devcon displays the status of each device.
FDC\GENERIC_FLOPPY_DRIVE\1&3A2146F1&0&0
Name: Floppy disk drive
Driver is running.
IDE\CDROMSAMSUNG_DVD-ROM_SD-608__________________2.2_____\4&13B4AFD&0&0.0.0
Name: SAMSUNG DVD-ROM SD-608
Driver is running.
IDE\DISKWDC_WD204BA_____________________________16.13M16\4457572D414D373032313633393820312
0202020
Name: WDC WD204BA
Driver is running.
ROOT\DMIO\0000
Name: Logical Disk Manager
Driver is running.
ROOT\FLOPPYDISK\0000
Device has a problem: 28.
ROOT\FLOPPYDISK\0002
Device has a problem: 01.
ROOT\FLOPPYDISK\0003
Device has a problem: 01.
ROOT\FLOPPYDISK\0004
Device is currently stopped.
ROOT\FTDISK\0000
Name: Volume Manager
Driver is running.
STORAGE\VOLUME\1&30A96598&0&SIGNATUREEA1AA9C7OFFSET1770DF800LENGTH3494AEA00
Name: Generic volume
Driver is running.
STORAGE\VOLUME\1&30A96598&0&SIGNATUREEA1AA9C7OFFSET7E00LENGTH1770CFC00
Name: Generic volume
Driver is running.
11 matching device(s) found on \\Server01.
Search Operations
find
findall
find
The find operation displays the instance ID and device description of devices installed on the computer that match the specified criteria.
Example 20: Find devices by hardware ID pattern.
The following command searches for mouse devices on Server01, a remote computer. Specifically, the command searches the Server01 computer for devices whose hardware ID or compatible ID includes "mou."
devcon /m:\\Server01 find *mou*
In this case, Devcon found both two mouse devices.
ROOT\*PNP0F03\1_0_21_0_31_0 : Microsoft PS/2 Mouse
ROOT\RDP_MOU\0000 : Terminal Server Mouse Driver
Because all of the Devcon display operations also find hardware IDs, you can use any display operation to search for hardware IDs. Select the operation based on the content that you need in the output. For example, to find the device drivers that mouse-related devices on a local computer use, submit the following command.
devcon driverfiles *mou*
In response, Devcon finds the devices and lists their drivers.
HID\VID_045E&PID_0039\6&DC36FDE&0&0000
Name: Microsoft USB IntelliMouse Optical
Driver installed from c:\windows\inf\msmouse.inf [HID_Mouse_Inst]. 2 file(s) used by d
river:
C:\WINDOWS\System32\DRIVERS\mouhid.sys
C:\WINDOWS\System32\DRIVERS\mouclass.sys
ROOT\RDP_MOU\0000
Name: Terminal Server Mouse Driver
Driver installed from c:\windows\inf\machine.inf [RDP_MOU]. 2 file(s) used by driver:
C:\WINDOWS\System32\DRIVERS\termdd.sys
C:\WINDOWS\System32\DRIVERS\mouclass.sys
2 matching device(s) found.
Example 21: Find devices by instance ID or class.
The following commands display all legacy drivers on the local computer. Because legacy drivers do not have a hardware ID, you must search for them by their instance ID (registry path), ROOT\LEGACY, or their setup class, LegacyDriver.
The first command finds legacy drivers by an instance ID pattern. The ID pattern is prefaced by the at (@) symbol to indicate an instance ID and followed by the wildcard character (*) to find all devices in the ROOT\Legacy subkey.
**devcon find @root\\legacy\***
The second command finds legacy devices by searching for all devices in the legacydriver class.
devcon find =legacydriver
Both commands produce the same output, in this case, finding the same 27 legacy devices.
ROOT\LEGACY_AFD\0000 : AFD Networking Support Environment
ROOT\LEGACY_BEEP\0000 : Beep
ROOT\LEGACY_DMBOOT\0000 : dmboot
ROOT\LEGACY_DMLOAD\0000 : dmload
ROOT\LEGACY_FIPS\0000 : Fips
ROOT\LEGACY_GPC\0000 : Generic Packet Classifier
ROOT\LEGACY_IPSEC\0000 : ipsec
ROOT\LEGACY_KSECDD\0000 : ksecdd
ROOT\LEGACY_MNMDD\0000 : mnmdd
ROOT\LEGACY_MOUNTMGR\0000 : mountmgr
ROOT\LEGACY_NDIS\0000 : ndis
ROOT\LEGACY_NDISTAPI\0000 : Remote Access NDIS TAPI Driver
ROOT\LEGACY_NDISUIO\0000 : NDIS Usermode I/O Protocol
ROOT\LEGACY_NDPROXY\0000 : NDProxy
ROOT\LEGACY_NETBT\0000 : netbt
ROOT\LEGACY_NULL\0000 : Null
ROOT\LEGACY_PARTMGR\0000 : PartMgr
ROOT\LEGACY_PARVDM\0000 : ParVdm
ROOT\LEGACY_RASACD\0000 : Remote Access Auto Connection Driver
ROOT\LEGACY_RDPCDD\0000 : RDPCDD
ROOT\LEGACY_RDPWD\0000 : RDPWD
ROOT\LEGACY_TCPIP\0000 : tcpip
ROOT\LEGACY_TDPIPE\0000 : TDPIPE
ROOT\LEGACY_TDTCP\0000 : TDTCP
ROOT\LEGACY_VGASAVE\0000 : VgaSave
ROOT\LEGACY_VOLSNAP\0000 : VolSnap
ROOT\LEGACY_WANARP\0000 : Remote Access IP ARP Driver
27 matching device(s) found.
findall
The findall operation finds all devices, including those that are represented in the registry, but are not present on the computer, because they have been moved or removed.
Example 22: Find (and find all) devices in a setup class
The following command finds all devices on the computer in the Net setup class. The equal sign (=) indicates that Net is a setup class and not an ID.
devcon findall =net
In response, Devcon lists the following seven devices in the Net setup class. The first six are standard miniport devices. The seventh device, the RAS async adapter, is a software-enumerated device (SW\*) that is not installed until it is needed.
PCI\VEN_10B7&DEV_9200&SUBSYS_00BE1028&REV_78\4&BB7B4AE&0&60F0: 3Com 3C920 Integrated Fast
Ethernet Controller (3C905C-TX Compatible)
ROOT\MS_L2TPMINIPORT\0000 : WAN Miniport (L2TP)
ROOT\MS_NDISWANIP\0000 : WAN Miniport (IP)
ROOT\MS_PPPOEMINIPORT\0000 : WAN Miniport (PPPOE)
ROOT\MS_PPTPMINIPORT\0000 : WAN Miniport (PPTP)
ROOT\MS_PTIMINIPORT\0000 : Direct Parallel
SW\{EEAB7790-C514-11D1-B42B-00805FC1270E}\ASYNCMAC : RAS Async Adapter
7 matching device(s) found.
The following command compares the find and findall commands by running a find command with the same parameters as the previous findall command.
devcon find =net
In response, Devcon lists the following six devices in the Net setup class.
PCI\VEN_10B7&DEV_9200&SUBSYS_00BE1028&REV_78\4&BB7B4AE&0&60F0: 3Com 3C920 Integrated Fast
Ethernet Controller (3C905C-TX Compatible)
ROOT\MS_L2TPMINIPORT\0000 : WAN Miniport (L2TP)
ROOT\MS_NDISWANIP\0000 : WAN Miniport (IP)
ROOT\MS_PPPOEMINIPORT\0000 : WAN Miniport (PPPOE)
ROOT\MS_PPTPMINIPORT\0000 : WAN Miniport (PPTP)
ROOT\MS_PTIMINIPORT\0000 : Direct Parallel
6 matching device(s) found.
The find command, which returns only currently present devices, does not list the software-enumerated device because it is not actually being used and software-enumerated devices are considered not-present if they are not being used.
Change Operations
classfilter
enable
disable
install
remove
restart
reboot
classfilter
Adds, deletes, displays, and changes the order of upper and lower filter drivers for a device setup class.
Example 23: Display the filter drivers for a setup class.
The following command displays the upper filter drivers for the DiskDrive setup class. Because this command does not include any classfilter operators, Devcon displays, but does not change, the filter drivers for the class.
devcon classfilter DiskDrive upper
In response, Devcon displays the new upper filter drivers for the DiskDrive class and confirms that it did not change them. In this case, the display shows that devices in the DiskDrive setup class use the PartMgr.sys (C:\Windows\System32\PartMgr.sys) upper filter driver.
Class filters unchanged.
PartMgr
Example 24: Add a filter driver to a setup class.
The following command adds a fictitious filter, Disklog.sys, to the list of upper filter drivers for the DiskDrive setup class.
This command uses the add-after (+) classfilter operator to load the Disklog driver after the PartMgr driver so that it receives data that has already been processed by PartMgr.sys.
When the command starts, the virtual cursor is positioned before the first filter driver. Because it is not positioned on a particular driver, Devcon adds the Disklog driver to end of the filter driver list.
The command also uses the /r parameter, which reboots the system if it is necessary to make the class filter change effective.
devcon /r classfilter DiskDrive upper +Disklog
In response, Devcon displays the current upper filter drivers for the DiskDrive class.
Class filters changed. Class devices must be restarted for changes to take effect.
PartMgr
Disklog
If you misspell the driver name, or try to add a driver that is not installed on the system, the command fails. Devcon will not add a driver unless the driver is registered as a service, that is, unless the driver has an subkey in the Services registry subkey (HKLM\System\CurrentControlSet\Services).
The following command tests this safeguard feature. It adds "Disklgg," instead of Disklog, to the list of upper filters for the DiskDrive class. The output demonstrates that the command fails.
devcon /r classfilter DiskDrive upper +Disklgg
devcon failed.
Example 25: Insert a filter driver in the class list.
The following command adds a fictitious filter driver, MyFilter.sys, to the list of upper filter drivers for the DiskDrive setup class. The command places MyFilter.sys between PartMgr.sys and Disklog.sys in the load order.
The following list shows the filter drivers for the DiskDrive class before the command is submitted.
PartMgr
Disklog
The first subcommand, @Disklog, uses the positioning operator (@) to put the virtual cursor on the Disklog filter driver. The second subcommand, -MyFilter, uses the add-before operator (-) to add MyFilter.sys before Disklog.sys.
The command also uses the /r parameter, which reboots the system if it is necessary to make the class filter change effective.
The positioning operator is essential in this example. Before Devcon processes any classfilter subcommands, the virtual cursor is at the beginning of the list and is not positioned on any filter drivers. If you use the add-before operator when the cursor is not on positioned on a driver, Devcon adds the driver to the beginning of the list. If you use the add-after operator when the cursor is not positioned on a driver, it adds the driver to the end of the list.
devcon /r classfilter DiskDrive upper @Disklog -MyFilter
In response, Devcon displays the current upper filter drivers for the DiskDrive class. ??
Class filters changed. Class devices must be restarted for changes to take effect.
PartMgr
MyFilter
Disklog
You can also use the following command to add the MyFilter driver between PartMgr and Disklog. In this example, the first subcommand, @PartMgr, positions the virtual cursor on the PartMgr filter driver. The second subcommand, +MyFilter, uses the add after operator (+) to add MyFilter.sys after PartMgr.
devcon /r classfilter DiskDrive upper @PartMgr +MyFilter
Example 26: Replace a filter driver
The following command replaces the original copy of MyFilter.sys with a new and improved version, MyNewFilter.sys, in the list of filter drivers for the DiskDrive setup class.
The following list shows the filter drivers for the DiskDrive class before the command is submitted.
PartMgr
MyFilter
Disklog
The first subcommand uses the delete operator (!) to delete MyFilter.sys from the list. This command deletes MyFilter from the list of upper filter drivers for the DiskDrive class. It does not affect the MyFilter.sys file in the C:\Windows\System32\Drivers directory.
The second subcommand uses the add-after operator (+) to place the new filter driver in the position that the deleted driver occupied. (The delete operator leaves the cursor on the position that the deleted filter occupied. Therefore, add-before (-) and add-after (+) have the same effect.)
The command also uses the /r parameter, which reboots the system if it is necessary to make the class filter change effective.
devcon /r classfilter DiskDrive upper !MyFilter +MyNewFilter
In response, Devcon shows the new class filter configuration for the DiskDrive class.
Class filters changed. Class devices must be restarted for changes to take effect.
PartMgr
MyNewFilter
Disklog
Example 27: Change the order of filter drivers
The following command changes the order of filter drivers for the DiskDrive setup class. Specifically, it reverses the order of the second and third filter drivers.
The following list shows the filter drivers for the DiskDrive class before the command is submitted and the intended result of the command.
| Before | After |
|---|---|
PartMgr |
PartMgr |
MyNewFilter |
Disklog |
Disklog |
MyNewFilter |
The first subcommand uses the delete operator (!) to delete Disklog from the list. The second subcommand uses the start operator (=) to move the virtual cursor back to the starting position, and then uses the positioning operator (@) to put the cursor on the PartMgr driver. The start operator is necessary because the virtual cursor only moves forward through the list. The final subcommand uses the add-after operator (+) to add Disklog after PartMgr.
devcon /r classfilter DiskDrive upper !Disklog =@PartMgr +Disklog
In response, Devcon shows the new class filter configuration for the DiskDrive class.
Class filters changed. Class devices must be restarted for changes to take effect.
PartMgr
Disklog
MyNewFilter
enable
The enable operation enables disabled devices on the system.
Example 28: Enable a particular device.
The following command enables a programmable interrupt controller that had been disabled to correct a system problem. Because the controller hardware ID, *PNP0000, includes an asterisk, the command uses the single quote character (') to direct Devcon to find the hardware ID precisely as specified in the command. Otherwise, the asterisk would be interpreted as a wildcard character.
devcon enable '*PNP0000
In response, Devcon displays the instance ID of the device, and explains that you must restart the system to enable the device.
ACPI\PNP0000\4&B4063F4&0 : Enabled on reboot
Not all of 1 device(s) enabled, at least one requires reboot to complete the operation.
You can respond by restarting the system, either manually, or by using the Devcon Syntax operation.
The following command adds the /r parameter to the previous command. The /r parameter reboots the system only when rebooting is required to complete an operation.
devcon /r enable '*PNP0000
In response, Devcon enables the device and then restarts the system to make the enabling effective.
When the system restarts, use a Devcon status command to confirm that the device is enabled.
devcon status '*PNP0000
ACPI\PNP0000\4&B4063F4&0
Name: Programmable interrupt controller
Driver is running.
Example 29: Enable devices by class.
The following command enables all printer devices on the computer by specifying the Printer setup class in the Devcon command. The command includes the /r parameter, which reboots the system if it is necessary to make the enabling effective.
devcon /r enable =Printer
In response, Devcon displays the instance ID of the printer that it found in the Printer class and reports that it is enabled. Although the command included the /r parameter, the system did not reboot because a reboot was not required to enable the printer.
LPTENUM\HEWLETT-PACKARDDESKJET_1120C\1&7530F08&0&LPT1.4 : Enabled
1 device(s) enabled.
disable
The disable operation disables the specified devices.
Caution
- If you have a USB keyboard or mouse installed on your computer, this test will disable or remove the device. To recover, you will need to use a PS/2 keyboard.
Example 30: Disable devices by an ID pattern.
The following command disables the USB devices on the local computer. It identifies the device by a hardware ID pattern, USB*. This pattern will match an device whose hardware ID or compatible ID begins with "USB." The command includes the /r parameter, which reboots the system if it is necessary to make the disabling effective.
Caution
- Before using an ID pattern to disable a device, determine which devices will be affected. To do so, use the pattern in a display command, such as devcon status USB* or devcon hwids USB*.
devcon /r disable USB*
In response, Devcon displays the instance IDs of the USB devices and reports that they are disabled. Although the command included the /r parameter, the system did not reboot because a reboot was not required to disable the devices.
USB\ROOT_HUB\4&2A40B465&0
: Disabled
USB\ROOT_HUB\4&7EFA360&0
: Disabled
USB\VID_045E&PID_0039\5&29F428A4&0&2
: Disabled
3 device(s) disabled.
Example 31: Disable devices by instance ID.
The following command disables the USB devices on the local computer. This command identifies the devices by their instance IDs (as indicated by the at character (@) that precedes each ID). Each instance ID is separated from the others by a space. Also, because the instance IDs include the ampersand character (&), they are enclosed in quotation marks. The command includes the /r parameter, which reboots the system if it is necessary to make the disabling effective.
devcon /r disable "@USB\ROOT_HUB\4&2A40B465&0" "@USB\ROOT_HUB\4&7EFA360&0" "@USB\VID_045E&PID_0039\5&29F428A4&0&2"
In response, Devcon displays the instance IDs of the USB devices and reports that they are disabled. Although the command included the /r parameter, the system did not reboot because a reboot was not required to disable the devices.
USB\ROOT_HUB\4&2A40B465&0
: Disabled
USB\ROOT_HUB\4&7EFA360&0
: Disabled
USB\VID_045E&PID_0039\5&29F428A4&0&2
: Disabled
3 device(s) disabled.
update
The update operation replaces the current device driver with the driver in the specified INF file.
Example 32: Update the driver for communication ports
The following command replaces the current device driver for communication ports on the system with the most suitable driver in the test.inf file. The command affects only only devices whose entire hardware ID is *PNP0501 (including the asterisk).
You can use this command to replace signed drivers on the system with alternate drivers for testing or troubleshooting, or to associate the devices with the newest version of the same drivers.
Caution
- Before replacing the driver for any device, determine which devices will be affected. To do so, use the pattern in a display command, such as devcon hwids '*PNP0501 or devcon driverfiles '*PNP0501. This is especially important in an update operation, because Devcon does not list the devices affected by an update command.
Note
- Commands using the update operation only affect devices that have a hardware ID that is identical to the hardware ID specified in the command, not a pattern or partial match.
devcon update test.inf *PNP0501
In response, Devcon displays the following success message.
Updating drivers for *PNP0501 from test.inf.
To verify that the update was successful, use the Devcon Syntax operation, which lists the INF file and device driver files associated with the device.
The following command lists the driver files used by devices with a hardware ID of *PNP0501. In this command, which can use ID pattern matches, the string must be preceded by a single quote character (') to specify a literal match. Otherwise, the asterisk in the hardware ID is interpreted as a wildcard character.
devcon driverfiles '*PNP0501
In response, Devcon displays the driver files for the communication ports. The display shows that the devices are now associated with the devices specified in the test.inf file.
ROOT\*PNP0501\PNPBIOS_1
Name: Communications Port (COM1)
Driver installed from d:\test.inf [ComPort]. 2 file(s) used b
y driver:
C:\WINDOWS\system32\DRIVERS\test.sys
C:\WINDOWS\system32\DRIVERS\serenum.sys
ROOT\*PNP0501\PNPBIOS_2
Name: Communications Port (COM2)
Driver installed from d:\test.inf [ComPort]. 2 file(s) used b
y driver:
C:\WINDOWS\system32\DRIVERS\test.sys
C:\WINDOWS\system32\DRIVERS\serenum.sys
2 matching device(s) found.
install
The install operation installs the supporting software for a device.
Example 33: Install a device
The following command uses Devcon to install a Loopback device on the local computer. The command includes the full path to the INF file for the device (netloop.inf) and a hardware ID for the device, which typically is provided by the manufacturer (*MSLOOP).
devcon /r c:\windows\inf\keyboard.inf *PNP030b
In response, Devcon reports that it installed the device by updating the driver files.
Updating drivers for *PNPO30b from c:\windows\inf\keyboard.inf
Example 34: Install a device using unattended setup
The following example demonstrates how to install the MS Loopback Adapter during an unattended installation of Windows XP.
Add the following files to a floppy disk: Devcon.exe, Netset.exe, a tool in the Windows Server 2003 Resource Kit, and Netloop.inf (C:\Windows\inf\netloop.inf).
To the [GUIRunOnce] section of the unattended setup file, add the following Devcon command:
a:\devcon install a:\Netloop.inf *MSLOOP
This command installs the loopback adapter by using Netloop.inf and the hardware ID, *MSLOOP. The single quote character preceding "*MSLOOP" tells Devcon to interpret the asterisk as part of the hardware ID, not as a wildcard character.
Also, to the [GUIRunOnce] section of the unattended setup file, add a Netset command that specifies the desired network configuration settings.
Run the unattended installation.
remove
The remove operation uninstalls devices from the computer by deleting the device entry from the registry.
Caution
- If you have a USB keyboard or mouse installed on your computer, this test will disable or remove the device. To recover, you will need to use a PS/2 keyboard.
Example 35: Remove devices by instance ID pattern
The following command removes all USB devices from the computer. It identifies the devices by an instance ID pattern that matches any instance ID (registry path) that begins with "USB\." The at character (@) distinguishes the instance ID from a hardware ID or compatible ID. The command also includes the /r parameter which reboots the system if it is required to make the remove procedure effective.
Caution
- Before removing any devices by using a pattern, determine which devices are affected. To do so, use the pattern in a display command, such as **devcon status @usb\\\*** or **devcon hwids @usb\\\***.
**devcon /r remove @usb\\\***
In response, Devcon displays the instance ID of the devices that it removed
USB\ROOT_HUB\4&2A40B465&0 : Removed
USB\ROOT_HUB\4&7EFA360&0 : Removed
USB\VID_045E&PID_0039\5&29F428A4&0&2 : Removed
3 device(s) removed.
Example 36: Remove a particular network device
The following command removes (uninstalls) the NDISWAN miniport from the local computer. The command specifies the Net class, and then refines the search by specifying devices in the class whose hardware ID or compatible ID include "ndiswan." The command also includes the /r parameter, which reboots the system if rebooting is required to make the remove procedure effective.
Caution
- Before removing any devices by using a pattern, determine which devices will be affected. To do so, use the pattern in a display command, such as devcon status =net *ndiswan* or devcon hwids =net *ndiswan*.
devcon /r remove =net *ndiswan*
In response, Devcon displays the instance ID of the device that it removed.
ROOT\MS_NDISWANIP\0000 : Removed 1 device(s) removed.
rescan
The rescan operation scans the computer for new Plug and Play devices.
Example 37: Scan the computer for new devices
The following command scans the local computer for new devices.
devcon rescan
In response, Devcon reports that it is scanning, but does not report finding any new devices.
Scanning for new hardware.
You can also use rescan on a remote computer. The following command runs the rescan operation on Server01, a remote computer, by adding the /m parameter to the command.
devcon /m:\\server01 rescan
restart
The restart operation stops and then restarts devices on the local computer.
Example 38: Restart a particular device
The following command restarts the loopback adapter on the local computer. The command limits the search to the Net setup class and, within that class, specifies the instance ID of the loopback adapter, ROOT\*MSLOOP\0000. The at character (@) identifies the string as an instance ID. The single quote character ('), which requests a literal search, prevents Devcon from interpreting the asterisk in the ID as a wildcard character.
devcon restart =net @'ROOT\*MSLOOP\0000
In response, Devcon displays the instance ID of the device and reports the result.
ROOT\*MSLOOP\0000 : Restarted
1 device(s) restarted.
reboot
The reboot operation restarts the system on the local computer.
Example 39: Restart the local computer
The following command restarts the operating system on the local computer and associates the action to a hardware installation. Unlike the /r parameter, the reboot operation does not depend on the return code from another operation.
You can include the command in scripts and batch files that require the system to reboot.
devcon reboot
In response, Devcon displays a message indicating that it is restarting the computer (Rebooting local machine.)
Devcon uses the standard ExitWindowsEx function to restart. If the user has open files on the computer or a program will not close, the system does not restart until the user has responded to system prompts to close the files or end the process.
See Also
Concepts
Devcon Overview
Devcon Remarks
Devcon Syntax
Alphabetical List of Tools
Pviewer Overview
Exctrlst Overview
Apmstat Overview