Find Drivers That Fail to Load at Boot

**7026** lists drivers that failed to load, **7000** names a service that did not start, and **219** reports a driver load failure with the status code.

Get-WinEvent -FilterHashtable @{LogName='System';Id=7000,7009,7011,7026,219} -MaxEvents 30 | Select-Object TimeCreated,Id,ProviderName,Message | Format-List

Old failures from previous boots add noise. Filtering by the last boot time shows only what is wrong now.

$boot = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
Get-WinEvent -FilterHashtable @{LogName='System';StartTime=$boot;Id=7000,7026,219} -ErrorAction SilentlyContinue | Select-Object TimeCreated,Id,Message | Format-List
$boot

A driver that failed at boot may have loaded later. The device status and the service state show the current reality, not the boot-time one.

Get-PnpDevice -Status Error | Select-Object Class,FriendlyName,Problem,InstanceId
driverquery /fo table | Select-String -Pattern 'False|Running' | Select-Object -First 10
driverquery /fo csv | ConvertFrom-Csv | Where-Object { $_.State -ne 'Running' } | Select-Object ModuleName,State

The driver name in the event is the service name, not the device name. The service's binary path points at the driver file and its device class.

Get-CimInstance Win32_SystemDriver | Where-Object State -ne 'Running' | Select-Object Name,DisplayName,PathName,StartMode,State
sc.exe qc <drivername>
Get-ChildItem "$env:systemroot\System32\drivers" -Filter *.sys | Sort-Object LastWriteTime -Descending | Select-Object -First 5 Name,LastWriteTime

A driver that fails at boot is usually a missing dependency or a wrong start type. An updated package or a corrected start type fixes it; forcing it to load does not.

Get-Service <drivername> | Select-Object Name,Status,StartType,RequiredServices
sc.exe qc <drivername>
sc.exe config <drivername> start= auto
Get-WinEvent -FilterHashtable @{LogName='System';Id=7026} -MaxEvents 3 | Select-Object TimeCreated,Message

The only proof is a clean boot. Read the same events again after a restart and check that the list is empty for that driver.

Restart-Computer
Get-WinEvent -FilterHashtable @{LogName='System';Id=7000,7026,219} -MaxEvents 10 | Select-Object TimeCreated,Id,Message
Get-CimInstance Win32_SystemDriver | Where-Object State -eq 'Stopped' | Select-Object Name,StartMode,State