Windows 11 Drivers & Updates Cheat Sheet

Sidebar

Operating Systems · Windows 11 Drivers & Updates Cheat Sheet

How to list drivers and who made them, see what Windows Update changed and when, line crashes up against those changes, and test one change at a time. The listing commands and the update history were run on the PC this was written on (Windows 11 Pro, build 26300) as a normal user. Driver Verifier's /querysettings was run; /reset and the Device Manager and DISM steps come from Microsoft's documentation or my own knowledge and were not run here.

List the Drivers

driverqueryDrivers loaded in the system (/v adds details, /si signing information, /fo csv for a file)

driverquery /siShows whether each device driver is signed and who the manufacturer is

Get-CimInstance Win32_SystemDriver | Where-Object State -eq 'Running'Running kernel drivers (194 here)

Get-CimInstance Win32_PnPSignedDriver | Where-Object DeviceNameDevice drivers with version, date and provider (217 with a provider here)

pnputil /enum-driversDriver packages in the driver store: published name oemNN.inf, original name, provider, version, date

Get-PnpDevice -PresentOnly | Where-Object Status -ne 'OK'Present devices with a problem (none here)

Get-WindowsDriver -OnlineThird-party driver packages with detail; needs administrator rights (not run here)

Who Really Made It?

(Get-Item C:\Windows\System32\drivers\x.sys).VersionInfo | Format-List CompanyName, FileVersion, ProductNameThe company named inside the file

Get-AuthenticodeSignature C:\Windows\System32\drivers\x.sysWho signed it. For most vendors' drivers this says Microsoft Windows Hardware Compatibility Publisher: certified by Microsoft, not written by Microsoft

File dateThe driver file's build date, not when it arrived on this PC

Driver store datepnputil /enum-drivers and Win32_PnPSignedDriver.DriverDate show the package date; also not the install date

Here21 of 194 running kernel drivers are not Microsoft's: VPNs (OpenVPN, WireGuard, NordVPN), TotalAV, Citrix USB, Killer, MediaTek, Realtek and AMD

Windows Update History

Settings > Windows Update > Update historyQuality, driver, definition and other updates, with dates. Direct page: ms-settings:windowsupdate-history

Get-HotFix | Sort-Object InstalledOn -DescendingInstalled quality updates (KB numbers)

$h = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher(); $h.QueryHistory(0, $h.GetTotalHistoryCount())

The full history, including feature updates (1,577 entries here). Filter Title for Windows 11, version to find them

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WindowsUpdateClient'; Id=19}Installation Successful events; Id 20 is a failed installation

Feature updateOn this PC: Windows 11, version 26H2 on 2026-10-08, then the October security update on the 14th, before the first bugcheck on the 19th

Line Crashes Up Against Changes

Kernel-Power 41 timesFrom the Crash Triage and Event Viewer sheets

Update history timesFrom above. Put both on one list, oldest first

Quiet gapNote the longest crash-free period before the first crash; a change just after a long quiet is the best-dated suspect

Also look atNew software, new hardware, driver installs not from Windows Update, antivirus changes, BIOS updates

CorrelationA lead, not a cause. Several things usually change in one update

Device Manager

devmgmt.mscWin+R, or right-click Start > Device Manager

Properties > DriverVersion, date, provider, and the buttons: Driver Details, Update Driver, Roll Back Driver, Disable Device, Uninstall Device

Roll Back DriverOnly available if Windows kept the previous driver; it is often greyed out (the course Windows 11 Troubleshooting & Administration 7 explains why)

View > Show hidden devicesReveals devices not currently connected, including old drivers

Yellow triangle / down arrowA problem code / a disabled device; the Device status box says which

Uninstall Device > delete the driver softwareRemoves the driver package too: note the version first

Repair Tools (Administrator)

sfc /scannowChecks protected system files and repairs from the local copy

DISM /Online /Cleanup-Image /RestoreHealthRepairs the component store SFC relies on; use when SFC cannot repair

sfc /verifyonlyChecks without repairing

OrderUsually DISM first, then SFC. Both take minutes and need administrator rights. Not run here

Driver Verifier

verifier /querysettingsShows the current settings; ran here as a normal user: Verifier Flags: 0x00000000, everything off

verifierAdministrator Command Prompt: opens Driver Verifier Manager

verifier /standard /driver x.sysStandard checks on one named driver

verifier /queryStatistics for the drivers being verified

verifier /resetTurn it off, then restart (Microsoft)

Microsoft's warningsRunning Driver Verifier could cause the computer to crash. Test computers only. Administrators only

Won't bootBoot into Safe Mode and run verifier /reset (the usual advice; not on the Microsoft page read for this sheet)

Before enablingRead the dumps first; if one names a driver, verify that driver alone

One Change at a Time

Log beforeDate, what you will change, the undo, the longest crash-free gap so far

Change one thingRemove one unused VPN; stop one service; one antivirus; roll back one driver

WaitSeveral times the longest gap you have seen. A quiet week proves nothing for a PC that crashes every few weeks

RecordCrash or no crash, and the date; then undo before the next change

Prove itThe convincing test is putting the change back and seeing the problem return

A Microsoft signature is not a Microsoft driver

Counting drivers by signer says almost everything is Microsoft's. Read the company named in the file; that is why the census here finds 21 other drivers instead of one.

Back up before touching a driver

Note the version, export the driver (pnputil /export-driver needs administrator rights) or keep the installer, and have the undo ready. A driver that fixes one thing can break another.