StartOverride subkey?

NTDEV
1

Hello all,

We have a few drivers in our VM environment and lately noticed that 2 of the drivers stopped loading at boot. After looking closely, I found that the drivers registry keys under CurrentControlSet\Services has a subkey called StartOverride with a key pair “2” with value “3”.

Now, I am confused what this key means and how it got added to our driver. After searching on MSDN documentation, I could not find any documentation on this key, it behaviour and who adds it. Can someone help me with understanding this?

Thanks,
MG

2

xxxxx@gmail.com wrote:

We have a few drivers in our VM environment and lately noticed that 2 of the drivers stopped loading at boot. After looking closely, I found that the drivers registry keys under CurrentControlSet\Services has a subkey called StartOverride with a key pair “2” with value “3”.

Now, I am confused what this key means and how it got added to our driver. After searching on MSDN documentation, I could not find any documentation on this key, it behaviour and who adds it. Can someone help me with understanding this?

I’m surprised you couldn’t find it; there was a discussion about this on
this list in Sept 2012.

This is an annoying new “feature” in Windows 8. If you have a boot
start driver, but the driver doesn’t acquire any hardware at boot time,
then the system decides you don’t really need to be boot start, and adds
the StartOverride key to force you back to system start instead of boot
start.

Does your device talk to hardware? If not, why do you need to be boot
start?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

So, one of the drivers is a Bus filter driver that falls in the group System Bus Extender. This driver is looking for unplug events of emulated devices. The other driver is a STORPORT miniport driver for disk.sys to attach to.

So, the weird thing is these drivers were functional until last week. Last week after MS release Windows updates, these 2 drivers started failing to load. This also applies to versions where updates were not installed. So does not seem related to updates per se but the timing is pretty odd.