Microsoft KB Archive/303128

= How To Debug Query-Remove Veto That Results from Open Handles to a Device =

Article ID: 303128

Article Last Modified on 9/7/2004

-

APPLIES TO


 * Microsoft Windows XP Professional

-



This article was previously published under Q303128



SUMMARY
If you try to disable or uninstall a device, and there are open handles to the device from any processes or programs, the PnP Configuration Manager will abort the query-remove operation on the device and prompt you to reboot the computer.

This usually happens when there are legacy programs that are unaware of PnP notifications that are &quot;talking&quot; to your device. Currently, there is no easy way to find and fix those offending programs. This is because the PnP Configuration Manager does not log any information about the processes that have open handles to the device being removed.

This article explains how to find the processes in question by using a kernel debugger on a checked build system.



MORE INFORMATION
To find out which process has the open handle (or handles), follow these steps:  Set up a kernel debugging session, and then break into the target computer. Set the value of the kernel global variable PiDumpVetoedHandles to 1 in the debugger to enable open handle logging, as follows:

eb nt!PiDumpVetoedHandles 1

If you want this setting to be preserved across reboots, use the Oh.exe utility, and then reboot the computer.

To download the Oh.exe utility, browse to the following Microsoft Web site:

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/oh-o.asp

 Disable or uninstall your device. If the query remove is vetoed because of open handles, you receive a message in your debugger similar to the following:

1:Beginning handle dump:

1: (Failed Query-Remove - *Might* by due to leaked handles)

1: DeviceObject:816CAEE0 ProcessID:1744T FileObject:817808D0 Handle:636T

1:Dump complete - 1 total handles found.

 Convert the Process ID (1744) in the preceding dump from decimal to hex value, and then use !process debugger command to dump the process information, as follows: !process 6D0

Searching for Process with Cid == 6d0

PROCESS 81729020 SessionId: 0 Cid: 06d0 Peb: 7ffdf000 ParentCid: 0358

DirBase: 0c3ae000   ObjectTable: e1cbfb60    TableSize: 33.

Image:  toast.exe

VadRoot 81651b68 Vads 39 Clone 0 Private 140. Modified 0. Locked 0.

DeviceMap e18913e0

Token                e10fb378

ElapsedTime        0:00:16.0008

UserTime            0:00:00.0031

KernelTime           0:00:00.0015

QuotaPoolUsage[PagedPool]      0

QuotaPoolUsage[NonPagedPool]      0

Working Set Sizes (now,min,max) (587, 50, 345) (2348KB, 200KB, 1380KB)

PeakWorkingSetSize      595

VirtualSize             20 MB

PeakVirtualSize        20 MB

PageFaultCount       603

MemoryPriority       BACKGROUND

BasePriority           8

CommitCharge       284

 For .NET, you can create a DWORD value named ReturnHandleInfo with the value 1 under the following registry key:

When you restart the computer, PnP will dump the veto information to SetupAPI.log during install and uninstall events.

