Using the Windows Driver Verifier

If you suspect that any of the drivers is not working correctly or, after analyzing a memory dump, you have identified the driver that caused the error, then to more thoroughly check the operation of the drivers, you can independently check the drivers using the check tool built into the operating system Verifier.exe.

Checking for unsigned drivers.

verifier and press Enter.
2) Select an item and press the button Further.
and press the button Further.
Simulating resource shortages and press the button Further.
Automatically select unsigned drivers and press the button Further.

If unsigned drivers are detected, the system will display you a list of them, which will indicate the driver files and their description. Moreover, the found drivers can belong to both devices and applications. Do not close the Driver Verifier window or press any buttons yet.

Option 1: Update the program or driver.

6) Visit the website of the device manufacturer or program author and download a newer version.
7) Reinstall the program or update the driver.
8) After updating the application or driver, close the Driver Verifier window by clicking Cancel.
9) Restart your computer and continue using the operating system.
If the system does not experience errors associated with this driver, then updating the driver or program has eliminated it.

Option 2: Uninstall the program or driver.

6.1) Uninstall the program that owns this driver.
6.1.1) Open Control PanelAll Control Panel ItemsPrograms and Features and uninstall the application that owns the driver.
Before uninstalling a program, make sure that you have its installation disk or that its installation is saved on your disk.

6.2) Uninstall the driver in Device Manager.
6.2.1) In the menu Start right click on Computer and select Properties.
6.2.2) Click on the list on the left on device Manager.
6.2.3) B Device Manager find the device, right-click on it and select from the context menu Properties.
6.2.4) Go to the tab Driver and press the button Delete.

7) After uninstalling the application or driver, close the Driver Verifier window by clicking Cancel.
8) Restart your computer and continue working in the operating system.

If the system does not experience errors associated with this driver, then uninstalling the driver or program has eliminated it.

Option 3: Checking for unsigned drivers.

Attention! After checking unsigned drivers, the system may not boot (before proceeding with further actions, read this option to the end).

6) Click the button Ready and restart your computer.

7) Restart your computer
8) Before Windows starts, press the F8 key. When the drive selection window appears: select the drive on which you have Windows installed, press Enter, and then immediately F8.
9) Select an item Safe mode
10) Open the dialog menu Execute: Start ->
11) Enter the command verifier.exe /reset and press Enter.

If the system boots in normal mode, the check for unsigned drivers is completed successfully - they are not the source of the problem.

Checking signed drivers.

1) In the Start menu search bar, enter verifier and press Enter.
2) Select an item Create non-standard parameters (for program code) and press the button Further.
3) Set the switch to Select individual parameters from a complete list and press the button Further.
4) Check all the boxes except the checkbox Simulating resource shortages and press the button Further.
5) Set the switch to Select driver name from the list and press the button Further.
6) Click on the column header Provider to sort drivers by their vendor.
7) Select the first 10-15 drivers by checking the boxes next to them in the column Check.
Do not select all drivers at once, as checking them will take a lot of time and system resources.
8) Click the button Ready and restart your computer. If the system boots in normal mode, the check of the selected drivers was completed successfully - they are not the source of the problem. In this case, repeat the steps described above, selecting the next 10-15 drivers.

If after a reboot a blue screen with an error appears, the problematic driver has been identified - its name will be included in the error message. In this case:

1) Restart your computer
2) Before Windows starts, press the F8 key. When the drive selection window appears: select the drive on which you have Windows installed, press Enter, and then immediately F8.
3) Select an item Safe mode
4) Open the dialog menu Execute: Start -> Run or press Win+R combination
5) Enter the command verifier.exe /reset and press Enter. If the check of all drivers completed successfully, then most likely the drivers are not the cause of the critical error occurring on your system.

The utility that we will describe today is called Driver Verifier and is included in all operating systems, including Windows XP. This program allows you to check and identify problematic ones that can greatly harm the system. The most famous problem is blue screen of death. Data about such drivers is recorded in a memory dump so that analyzes can be carried out later. So, the utility subjects drivers to so-called stress situations (tests), creating visual extreme conditions, for example, lack of memory, various locks, IRQL, IRP checks, DMA, etc., I/O control. In other words, extreme situations are simulated that should not occur during normal work with Windows, or they do not happen often. Thus, the utility allows you to identify drivers that can lead to a system crash.

As I already said, the utility is built into all versions of Windows and is located on the path %windir%\system32. The utility can also be used in two versions: command line and graphical interface.

So, in order to run the driver checker utility, you need to open the window "Run" type the following command:

verifier

A window opens with the necessary settings, in which we select the second item - "Create custom parameters" or "Create custom settings".

Now we need to sort the contents; to do this, click on the word at the top of the table Provider. Now you can select all drivers. By the way, you don’t have to choose drivers from Microsoft.

Now you can press the button Finish, after which you will be asked to reboot the system.

So, the reboot has completed, and now the system will boot in driver verification mode. The utility will run in the background, conducting various tests. You can calmly work at the computer until the utility finishes. After work, the information file will be saved in a memory dump. Such a file is usually located along the path: C:\Windows\Minidump\*.dmp. Now it can be analyzed, for example, using Windbg, or another similar program.

If within a few days it turns out that the problem did not recur, then we can say that the problem is not in the drivers at all and you will have to look for the cause elsewhere. In the meantime, you can already disable driver verification mode. I want to say right away that this mode greatly slows down the system, therefore, it is not recommended to work with it often.

You can disable the utility like this: in the command line, enter the following command:

verifier/reset

Or from the graphical window of the program. To do this, select the item Delete existing settings.


If this mode cannot be turned off, then this can be done from .

If Windows does not want to boot in safe mode, then you should remove some keys. To do this you need to boot from a flash drive or disk.

Remove these keys:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

To find out if the utility is disabled, enter the following command in:

verifier/query

That's all. I hope this article helped you in solving your problems.

The Driver Verifier utility (verifier.exe) is designed to analyze problematic drivers when analysis of memory dumps after a BSOD does not allow finding the problematic driver. Driver Verifier is a “lifesaver” in the most problematic situations.

With Driver Verifier you can:

    driver stress test (resource shortage conditions are simulated);

    buffer overflow control;

    control over errors that occur due to incorrect operation at a given IRQL;

    I/O error analysis;

    detection of deadlock situations, etc.

The Driver Verifier utility is very useful when:

    the administrator (user) has suspicions that this particular driver is causing the system to crash and he wants to further check whether this is actually the case;

    driver developers want to test their driver;

    When analyzing a dump after a BSOD, it is impossible to find the problematic driver.

One of the most difficult cases of analyzing memory dumps is when a driver mistakenly overwrites data before or after the end of the buffer it allocated. In such cases, errors occur in the OS kernel (for example, analysis of a dump after a BSOD shows that the error occurred in ntoskrnl.exe).

Let's look at a similar case using a specific example. Using the NotMyfault utility, we cause BSOD - “Buffer overflow”.

The result of dump analysis using windbg is attached below.

According to the dump analysis we get:

1. Arg1: 00000007, Attempt to free pool which was already freed (an attempt was made to release an already freed pool)

2. IMAGE_NAME: ntkrpamp.exe (the core of the system itself has something to do with this)

It is with such errors that verifier comes to the rescue.

Launch verifier.

Select “Create non-standard parameters”. Next, select “Select parameters from list”.

Select everything except “Simulate resource shortage”.

Then select “Select unloaded drivers for this list” and specify the path to the myfault.sys driver, which is located in the same directory as the NotMyfault.exe program.

Then mark the driver and click “Finish”. After this, we need to reboot the computer.

We perform all the same actions as at the beginning. Run NotMyfault.exe, select “Buffer overflow” and click “Crash”. As you noticed, a crash may not happen immediately, since who and when will try to work with this memory is unknown in advance. As you can see in the image below, thanks to the verifier, the system can identify the problematic driver.

I will give an analysis using!analyze –v in windbg.exe of a memory dump after a BSOD.

The verifier program makes it so that the driver being tested, instead of ordinary memory available in the kernel, uses a special pool designed to detect such an error. Thanks to this, you can find the driver that causes the BSOD.

If we look at the results of the analysis, we see the following.

1. DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (d6) – this is one of the errors that is generated by verifier

2. IMAGE_NAME: myfault.sys – driver that caused the problem.

Thus, if analyzing a memory dump after a BSOD does not allow you to find the “culprit driver,” use the verifier.exe program (install all checks, except for lack of memory).

The simplest way to use Driver Verifier (verifier.exe) is to run it with the following parameters:

verifier /standard /driver driver file name

Indicates a system driver that is unlikely to be causing the problem (for example, win32k.sys). In this case, a serious analysis of the dump will be required, requiring very deep knowledge and experience in this area. However, you can check your drivers yourself using the operating system's built-in driver checker. Verifier.exe. Although it is covered in detail in the Microsoft knowledge base article Using the Driver Verifier to troubleshoot Windows driver problems, the material presented there is presented at a fairly advanced technical level. Below is a brief description of the steps you need to follow to check your drivers.

On this page

Getting started with the Driver Verifier

On the menu Start - Execute(or Start - Search) enter verifier and press Enter. The Driver Checker will launch. Select an item Create non-standard parameters (for program code) and press the button Further.

Select individual parameters from a complete list and press the button Further.

In the next step, check all the boxes except Simulating resource shortages and press the button Further.

In the next step, select Automatically select unsigned drivers and press the button Further. If no unsigned drivers are found, go to .

Unsigned drivers

If unsigned drivers are detected, you will see a list of them.

Drivers can belong to both devices and applications. Do not close the Driver Verifier window or click the Further Now.

Search for updated drivers

You need to check if there are updated drivers.

  1. If you see an application driver in the list, visit its manufacturer's website - the application may have been updated. If there is no updated version, you can try uninstalling the app (you can always reinstall it later). If critical errors stop, that was the cause.
  2. If you see a device driver in the list and are running Windows Vista, use Windows Update to search for new drivers. This method works well for Windows Vista because many device manufacturers work with Microsoft to make their drivers available for download through Windows Update. In Control Panel, select Windows Update and check for updates to your device driver. If the driver is found, install it.
  3. If Windows Update doesn't offer you new drivers, visit the device manufacturer's website. Perhaps new drivers are available there. If you are having problems finding drivers, please contact the forum on the site.

After updating an application or driver, close the Driver Verifier window. pressing a button Cancel(but not Further) . Restart your computer and continue using the operating system. If the critical error no longer occurs, you have resolved it by updating the driver.

Removing drivers

If new drivers cannot be found, try uninstalling the driver.

Attention! Removing drivers leads to device inoperability. After a reboot, in the best case, the operating system will install the appropriate driver from its own driver store. If you are not sure whether to remove a particular driver, do not remove it.

In Device Manager ( Start - Search / Run - devmgmt.msc - OK) find the device, right-click on it and select from the context menu Properties. Then go to the tab Driver and press the button Delete.

Checking for unsigned drivers

Attention! After checking unsigned drivers, the system may not boot (described below is how to act in such a situation).

If you do not want to remove the driver and/or want to check for unsigned drivers, in the Driver Verifier window, click Further. You will be prompted to select a physical disk.

Ready, then restart your computer. If after rebooting you see a blue screen with an error, the problematic driver has been identified - its name will be included in the error message. Restart your computer and enter safe mode by clicking F8 Start - Search / Run team verifier.exe /reset.

If the system boots in normal mode, the check for unsigned drivers is completed successfully - they are not the source of the problem. You can see a list of tested drivers by running verifier.exe .

Since unsigned drivers are not the cause of a fatal error, you need to check other drivers.

Custom driver check

If no unsigned drivers are found or checking them does not reveal any problems, you will have to perform a custom driver check. In this case, in the window shown below, select Select driver name from the list.

In the next step, you will be asked to select drivers to scan. Don't select all drivers at once, since checking them will take a lot of time and system resources.

Therefore, the verification may have to be carried out in several stages. The step-by-step sequence for selecting drivers could be as follows:

  1. Recently updated drivers or those that typically cause problems (antivirus drivers, firewall drivers, virtual disks).
  2. Drivers not supplied by Microsoft.
  3. Group of 10 - 15 drivers at a time.

Select the drive on which the operating system is installed and click Ready, then restart your computer.

Attention! After checking the drivers, the system may not boot (described below is how to act in such a situation).

If after rebooting you see a blue screen with an error, the problematic driver has been identified - its name will be included in the error message. Restart your computer and enter safe mode by clicking F8 while loading. After logging in, reset all driver verification settings by entering Start - Search / Run team verifier.exe /reset.

If the system boots in normal mode, the check of the selected drivers was completed successfully - they are not the source of the problem. You can see a list of tested drivers by running verifier.exe and selecting the item in the first step Display information about currently verified drivers.

Now select the next driver group and check again.

All drivers have been checked - what next?

If the check of all drivers was successful, I have to take my hat off to your patience and perseverance. Most likely, drivers are not the cause of the critical error occurring on your system. It is possible that the problem lies in the hardware of your computer - for example, a faulty hard drive or RAM, or the power supply is not powerful enough to power all devices. There may be other hardware problems that also cannot be identified by checking the drivers.

So, you have a recurring blue screen of death, and like many BSoDs, it's because a bad driver is to blame. However, the screen does not give you the correct information, either because it does not contain any driver at all, or because it lists a system driver that is acting as false.

Driver Verifier is a free utility included in all versions of Windows from Windows XP. It literally checks each of the drivers on your PC until it encounters the issue that is causing the problem, intentionally creating the same blue screen but then writing the information to a log file to help you identify the problem.

Launch Driver Driver

If you're experiencing the same blue screen frequently and you'd like to get proactive and fix it, here's how to use Driver Verifier.

  1. Click the button Start
  2. Click " Execute"...
  3. Enter CMD and press Enter.
  4. In the new window, enter verifier and press Enter.


On Windows Vista and 7:

  1. Click the button Start
  2. Enter CMD in the field and click Enter.
  3. In the new window, enter verifier and press Enter.


On Windows 8 and 8.1:

  1. Press the key Windows + X
  2. Click " Command Line (Administrator) (Windows PowerShell (Admin) in Windows 8.1)
  3. In the new window, enter verifier and press Enter.


All Windows versions:

  1. Make sure it's selected setting up user settings (for code developers) .
  2. Click " Further" .
  3. Select " Select individual settings" from the full list .
  4. Click " Further" .
  5. Deselect low resource system modeling And standby I/O requests. (These two cause unnecessary workload on your PC.) Make sure everything else is selected.
  6. Double tap " Further" .
  7. Select " Select driver names" in the list .
  8. Click " Further" .
  9. Select all drivers on this screen except those that say Microsoft Corporation under Supplier. It is very unlikely that a Microsoft driver is causing this problem.
  10. Click " Ready" .


Note. If you can't complete the above steps because the blue screen keeps happening, try booting to .

At this point, you must restart your computer. Then try causing the BSoD again by doing what you did before. Windows adds extra workload to your drivers to help you. If you can't reproduce the BSoD, try running your computer overnight. Once the BSoD appears again, reboot your computer and read the Minidump file.


Reading a dump file

The Verifier driver will launch, blue screen, and write a log file. This log file is located in C:\Windows\Minidump\. Read it and you will see which driver is causing this problem. Try searching for the driver name to see what piece of hardware your PC uses.

So how do you read it? You need a debugging tool, which you can download from Microsoft.

A . Download the SDK, install it, select debugging tools, and deselect everything else.

Please note that debugging tools for previous versions of Windows are no longer available; you will have to send the dump file to a Microsoft technician for analysis.


After installing it, find it on the startup screen. It's called windbg (x64). Launch it.

  1. Click " File", then " Open failure" .
  2. Switch to C:\Windows\Minidump\ and open the .DMP file contained inside.
  3. Look at the bottom of the resulting file where the line says " Probably caused". This is a good indication of which driver is causing this problem.

Fix driver

Update the driver associated with this hardware:

  1. Click the button Start
  2. Click Control Panel
  3. Click " Switch to classic view"
  4. Double click system
  5. Go to "Hardware" tab
  6. Click device Manager
  7. Click " Update driver."

On Windows Vista and 7:

  1. Click the button Start
  2. Click Control Panel
  3. Double click device Manager
  4. Find the device causing the problem
  5. Right click on it
  6. Click " Update driver."


On Windows 8 and 8.1:

  1. Press the key Windows + X
  2. Click Control Panel
  3. Browse by small icons
  4. Click device Manager
  5. Find the device causing the problem
  6. Right click on it
  7. Click " Update driver."

Or use our application so as not to be confused with Driver Verifier. Driver Reviver automatically updates all existing drivers on your PC and is especially good at updating underperforming drivers like this one to the latest and greatest version.

After fixing the driver issue, you will want to disable Driver Verifier.

Disable driver verifier

Once you are done using Driver Verifier, you will want to disable it as it is quite hard on your PC while it is running.

On all versions of Windows:

  1. Re-run Driver Verifier using the steps above.
  2. Select " Delete existing settings" .
  3. Click " Ready" .
  4. Restart your computer again.


Bookmark this article for future reference so that whenever you have a blue screen, you can fix the problem. Also, check out our interactive and enter your error name for more tips on resolving your specific Blue Screen of Death. Good luck!