Mini-filter driver / .inf / DIRID 13 / install & uninstall

For the file system mini-filter driver project that I'm currently working on, the .inf file has finally been populated to support both x64 & ARM64, and is using DIRID 13 (Driver Store) as the destination. Building the driver for both x64 & ARM64 is working just fine, including the verifying of the .inf file and the creation of the .cat file.

I have Hyper-V virtual machines running Windows 11 24H2 (x64 & ARM64) and Windows Server 2025 24H2 (x64), with all of the gpedit.msc & bcdedit.exe "tweaks" applied for test-mode so that test-signed drivers can be installed & loaded, and the HLK 24H2 (May 2025) client is installed on all 3 of the VM. In the file explorer, I can do a "right-click -> Install", and the driver is correctly installed to the driver store and the driver's service is created. Likewise, rundll.exe & setupapi.dll can be used from the command line to perform the same driver installation operation. A subsequent "fltmc load" command results in the driver loading and attaching to a volume, or a reboot can be performed. So far, so good.

What I'm having difficulty finding is how to properly uninstall the driver from the driver store. If DIRID 12 was being used, the file paths would be invariant and the task would be as simple as deleting the service and then deleting the driver files from disk. Ideally, I need to be able to automate deployment of just the driver to my HLK client VMs, including complete cleanup of an older build before a newer build needs to go through HLK testing.

Per Microsoft's documentation, usage of a default uninstall section in the .inf file is now forbidden, ditto for a section to uninstall the service.

Google searches have mostly turned up options based on GUI tools, including a driver store explorer, none of which are acceptable for automation purposes.

The best method that I've found so far is this:

https://stackoverflow.com/questions/78644706/powershell-delete-driver-from-windows-driverstore

It uses the PowerShell cmdlet "Get-WindowsDriver -Online" to obtain an array of objects to iterate through, which allows me to find the entry with my driver's .inf file name as the "original" file name and correlate it with an "oem<#>.inf" file (ex. "oem5.inf") which can then be passed to "pnputil /delete-driver oem<#>.inf /uninstall /force". That resulted in the driver being deleted from the driver store location on disk, but it left the service present with the start type set to "disabled" and fltmc.exe still showed the driver as loaded. Issuing either "fltmc unload " or simply rebooting was sufficient to leave no active "residue"

What is the recommended "best practices" method of performing the uninstallation from the command line? Any links to appropriate online documentation from Microsoft would be helpful. Eventually, there will be a WiX project to create an MSI package for the driver, but it's "putting the cart before the horse" right now to require an MSI package for use on the HLK client machines if any other more simple method can be used.

It seems like so much of the relevant documentation is now riddled with errors, out-of-date or contradictory that it's become very frustrating trying to find out what, exactly, is required "end to end" for bringing a new driver project up from scratch starting with the .sys/.inf/.cat files, building out the HLK environment, performing the correct set of tests and merging all required .hlkx files for submission to Microsoft for signatures. Even the current HLK 24H2 (May 2025) documentation references non-existent playlist files for testing on ARM64.

The only relevant and accurate documentation, AFAIC, is the devcon sample in microsoft's driver samples repo on github. This has been the case for the last 25 years or so.

I have only been using DIRID 12 but:
if the driver is miniport driver it needs a reboot to completely be removed.
sorry I can not remember where this is documented if all.

if it a 'pure' filter driver then it you can uninstall and update it without reboot.

the worst is when there is a windows update pending, I have seen at least once after update you get old driver back.

It's a pure file system mini-filter driver... software-only... not physical hardware associated with it.

I've been looking at the source code for DevCon, as was recommend. I had initially discounted devcon.exe as all of Microsoft's current documentation shows repeatedly that it's been replaced by pnputil.exe, which is shipped with Windows itself. However, the source code for DevCon is at least showing usage examples for the 3 uninstallation steps that I've been having to piece together with PowerShell & pnputil.exe, so it seems quite reasonable to write a bit of C++ or C# to create a low-level driver / driver package uninstall program that can be used by my MSI package. It appears that the v3 WiX toolset is now no longer supported, with the driver extension going deprecated in v4 and completely removed from v5. From all that I've been reading, WiX no longer has any device driver / driver package support present in it and installer package developers are left to create their own from scratch.

1 Like

C# is less straightforward than C++ in this case.

I've been playing around with 'devcon in a class' here: HtsVsp/App/vspControl at main · HollisTech/HtsVsp
and it is a public repo, so feel free to borrow from it.