How to Disable and Enable Windows Device Drivers

From time to time there may be a reason to disable or enable a driver through the registry. Some examples include:

  • Software installation or updates enable/disable drivers that may be needed
  • A driver needs to be removed, but there is no uninstaller available. This is the case for some drivers such as secdrv.sys that can be found in certain security audits.
  • The system has frequent crashes and unsigned drivers need to be disabled to troubleshoot the issue.
  • A driver needs to be temporarily disabled to identify a cause for an issue.  
  • Viruses/malware that present themselves as distinct kernel mode drivers, but where there is no current ability to clean with an antivirus/antimalware program

Drivers have a corresponding service entry in the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services). Each of the keys that represents a driver has a "Start" value of type REG_DWORD that specifies the startup type from the driver. Below is a list compiled from Windows Internals and MSDN that describes the different startup types for device drivers. I also include the startup type listed in msinfo32.exe for each driver startup type.

MSinfo32.exe Start ModeStartup TypeValueDescription
BootSERVICE_BOOT_START0x00000000Drivers that need to be loaded by the boot loader to successfully boot the system.
SystemSERVICE_SYSTEM_START0x00000001The driver is not required for system start, but identifies a device that the associated bus driver cannot enumerate.
AutoSERVICE_AUTO_START0x00000002The driver is started automatically, but is not required at system boot time.
ManualSERVICE_DEMAND_START0x00000003The driver is started on demand by either the service control manager or the PnP manager. This setting is used when the driver is not required at boot time.
DisabledSERVICE_DISABLED0x00000004The driver does not start in this case.

To disable a driver, simply change the Start value for the driver in the system registry to 4. As an example, I disabled the CDROM driver (cdrom.sys) for a VM. It shows that there is a possible issue in device manager and properties for the device show the error message "A driver (service) for this device has been disabled. An alternate driver may be providing this functionality.