Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am getting a UAC prompt after boot for a device driver installation - I'm not sure where this is from however and would like to inspect the command (or possibly remove it) that is causing the driver installation to start.

I assume this is stored somewhere in the registry - could anyone point me at the correct place where this installation is being started from?

share|improve this question
    
Snoop around using Autoruns and you'll find it. –  Andrew Lambert Mar 1 '12 at 7:20
add comment

1 Answer 1

Pending operations are located in this registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\KeysNotToRestore

and in the current control set such as CurrentControlSet*n* where n is the "ccs" in use

It's possible to view all pending operation with the Sysinternals PendMoves utility:

http://technet.microsoft.com/en-us/sysinternals/bb897556

You may use PendMoves in combination with NirSoft's ServiWin to check all drivers and how they are started...

BTW: you may download and update all Sysinternals utilities (as well as NirSoft utilities) with WSCC utility http://www.kls-soft.com/wscc/index.php

Hope this help. Let us know.

share|improve this answer
    
Unfortunately that only shows file operations that are to be performed on the next boot, it doesn’t indicate registry operations, service, or driver changes. :-( Like Amazed said, Pending Autoruns will be necessary to see what is set to be run, followed by research to figure out what they are doing (it depends on the app). That plus PendingFileRenameOperations should do the trick (at least most of the time). –  Synetech Mar 2 '12 at 5:34
    
:-\ You're right Synetech. So, instead the user may look at Process Monitor with the option "enable boot logging" combined with filters option... –  climenole Mar 2 '12 at 8:43
    
Another option is to try some of those “installation monitoring programs”. They will take a snapshot of the system before and after and compare, but of course that doesn’t really help in this case. However, some installation monitors actually hook into the system and monitor changes, so that would help (I recall one that starts with a ‘Z’). –  Synetech Mar 2 '12 at 21:14
    
Installation monitoring software? May be TotalUninstall (shareware but free for 30 days...) Also take a look at System Explorer: it's possible to create a snap shot of registry and/or files and compare them. –  climenole Mar 2 '12 at 23:20
    
I meant ZSoft Uninstaller. It was the one of the best I tried because it hooked the system like Process Monitor, but unlike Process Monitor, instead of just showing everything, it is specifically meant to show changes. –  Synetech Mar 3 '12 at 0:34
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.