I have an NDIS6 LWF which install/uninstalls on many (>30) WIN2k8 R2 machines without any problems. But I have one machine that consistently hangs whenever the driver is uninstalled i.e. the uninstall never completes and a reboot is required after which the derive is no longer listed in the stack.
As luck would have it I have another machine that is identically configured so I enabled NDIS tracing on both machines using:
logman create trace ndis -o c:\ndis.etl -ets
logman update ndis -p {DD7A21E6-A651-46D4-B7C2-66543067B869} 0x31F3 5 -ets
And compared the two traces. The good machine reports:
[2]1128.04D4::05/10/2011-14:43:11.221 [mp]==>ndisHandleProtocolReconfigNotification: Protocol {Local Area Connection 2}
[2]1128.04D4::05/10/2011-14:43:11.221 [mp]==>ndisReferenceProtocolByName: Protocol: {Local Area Connection 2}
[2]1128.04D4::05/10/2011-14:43:11.221 [mp]<==ndisReferenceProtocolByName: Protocol 0000000000000000, Status c0000034
[2]1128.04D4::05/10/2011-14:43:11.221 [mp]<==ndisHandleProtocolReconfigNotification: Protocol 0000000000000000
[2]1128.04D4::05/10/2011-14:43:11.222 [mp]==>ndisHandleProtocolReconfigNotification: Protocol {Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}
[2]1128.04D4::05/10/2011-14:43:11.222 [mp]==>ndisReferenceProtocolByName: Protocol: {Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}
[2]1128.04D4::05/10/2011-14:43:11.222 [mp]<==ndisReferenceProtocolByName: Protocol 0000000000000000, Status c0000034
[2]1128.04D4::05/10/2011-14:43:11.222 [mp]<==ndisHandleProtocolReconfigNotification: Protocol 0000000000000000
[3]1128.04D4::05/10/2011-14:43:11.295 [mp]==>ndisHandleFilterDetachNotification, Device \Device{Local Area Connection 2}, Filter {RtpBridge}
[3]1128.04D4::05/10/2011-14:43:11.295 [mp]==>ndisReferenceMiniportByGuid Miniport name \Device{Local Area Connection 2}
[3]1128.04D4::05/10/2011-14:43:11.295 [mp]<==ndisReferenceMiniportByGuid Miniport 0000000000000000
[3]1128.04D4::05/10/2011-14:43:11.295 [mp]<==ndisHandleFilterDetachNotification: Filter 0000000000000000, Status c0000034
[1]1128.04D4::05/10/2011-14:43:11.362 [mp]==>ndisHandleFilterDetachNotification, Device \Device{Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}, Filter {RtpBridge}
[1]1128.04D4::05/10/2011-14:43:11.362 [mp]==>ndisReferenceMiniportByGuid Miniport name \Device{Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}
[1]1128.04D4::05/10/2011-14:43:11.362 [mp]==>ndisReferenceMiniportByName: Miniport name \DEVICE{Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}
[1]1128.04D4::05/10/2011-14:43:11.362 [mp]<==ndisReferenceMiniportByName Miniport FFFFFA8003FAE1A0
[1]1128.04D4::05/10/2011-14:43:11.362 [mp]<==ndisReferenceMiniportByGuid Miniport FFFFFA8003FAE1A0
[1]1128.04D4::05/10/2011-14:43:11.362 [mp]==>ndisReadMiniportFilterList: Miniport FFFFFA8003FAE1A0
[1]1128.04D4::05/10/2011-14:43:11.363 [mp]<==ndisReadMiniportFilterList: Miniport FFFFFA8003FAE1A0
[1]1128.04D4::05/10/2011-14:43:11.363 [mp]==>ndisReferenceFilterDriverByName FilterName: {RtpBridge}
. . .
The bad machine
[1]0FE8.08A4::05/10/2011-13:22:05.093 [mp]==>ndisHandleProtocolReconfigNotification: Protocol {Local Area Connection 2}
[1]0FE8.08A4::05/10/2011-13:22:05.093 [mp]==>ndisReferenceProtocolByName: Protocol: {Local Area Connection 2}
[1]0FE8.08A4::05/10/2011-13:22:05.093 [mp]<==ndisReferenceProtocolByName: Protocol 0000000000000000, Status c0000034
[1]0FE8.08A4::05/10/2011-13:22:05.093 [mp]<==ndisHandleProtocolReconfigNotification: Protocol 0000000000000000
[1]0FE8.08A4::05/10/2011-13:22:05.093 [mp]==>ndisHandleProtocolReconfigNotification: Protocol {Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}
[1]0FE8.08A4::05/10/2011-13:22:05.093 [mp]==>ndisReferenceProtocolByName: Protocol: {Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}
[1]0FE8.08A4::05/10/2011-13:22:05.093 [mp]<==ndisReferenceProtocolByName: Protocol 0000000000000000, Status c0000034
[1]0FE8.08A4::05/10/2011-13:22:05.093 [mp]<==ndisHandleProtocolReconfigNotification: Protocol 0000000000000000
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]==>ndisHandleFilterDetachNotification, Device \Device{Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}, Filter {RtpBridge}
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]==>ndisReferenceMiniportByGuid Miniport name \Device{Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]==>ndisReferenceMiniportByName: Miniport name \DEVICE{Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)}
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]<==ndisReferenceMiniportByName Miniport FFFFFA80040201A0
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]<==ndisReferenceMiniportByGuid Miniport FFFFFA80040201A0
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]==>ndisReadMiniportFilterList: Miniport FFFFFA80040201A0
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]<==ndisReadMiniportFilterList: Miniport FFFFFA80040201A0
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]==>ndisReferenceFilterDriverByName FilterName: {RtpBridge}
[1]0FE8.08A4::05/10/2011-13:22:05.223 [mp]<==ndisReferenceFilterDriverByName
. . .
I replaced the GUIDs with the names to make the comparisons easier and RtpBridge is my LWF.
So the good machine receives an extra:
[3]1128.04D4::05/10/2011-14:43:11.295 [mp]==>ndisHandleFilterDetachNotification, Device \Device{Local Area Connection 2}, Filter {RtpBridge}
Any idea how I can go about debugging this further?