How to find pool tags that are used by third-party drivers

This article describes how to find the source of a pool tag that is used by a third-party driver. This may be useful because when you troubleshoot an issue, you may encounter a pool tag that cannot be tied to a Microsoft component, and finding the source of these tags can be complicated and is often impossible without the use of a kernel-mode debugger.

To find files that (potentially) use a given pool tag, use the Search tool in Windows 2000:

1. Click Start, point to Search, and then click For Files or Folders.
2. In the Search for files or folders named box, type *.sys.
3. In the Containing text box, type the pool tag you want to search for.
4. In the Look in box, type the path to the system root drivers, for example, C:\WINNT\system32\drivers, and then click Search Now.

You should receive a list of drivers that contain the tag. Although there may be some false hits here (as the text string may naturally occur in other files), this method should allow you to narrow the scope of your search.

You can use the findstr command (in all versions of Windows) instead of Windows Explorer. To minimize the occurrence of false hits, change to the system root\drivers folder at a command prompt. If needed, use Windows Explorer to find this folder. Run the findstr /m /l tag *.sys command, where the /m switch is used to list only the file name. If you receive multiple files, try to reduce the amount of files returns by adding the letter "h" to the tag before you run the search. This is mainly useful when the tag is comprised of three letters.

Note You may find that this query may not find the appropriate driver because the driver is not loaded from %SYSTEMROOT%\drivers. In this case, run more global searches such as findstr /m /l tag *.sys that start from %SystemRoot%, %ProgramFiles%, %SystemDrive%, %ProgramData%. For examples, use the findstr /m /l hTCPt *.sys command to return Tcpip.sys and findstr /m /l hCPnp *.sys to return Classpnp.sys or Acpiec.sys depending on which operating system you are running.

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base: