Consider the following scenario:
- You have developed an application that works on Windows 10 Long Term Servicing Branch (LTSB).
- The application relies on custom or third-party universal serial bus (USB) device drivers.
- The application logic expects to find these drivers in the INF cache. Therefore, devices are automatically identified without having to specify the driver on each connection.
- You install some Windows updates.
In this scenario, the drivers are silently removed from the INF cache. Therefore, the application cannot use the drivers as expected.
Additionally, when the scenario occurs, the Process Monitor log shows the following chain:
11:55:21.8170826 svchost.exe 868 2424 Process Create C:\Program Files\rempl\remsh.exe SUCCESS PID: 3076,
Command line: "C:\Program Files\rempl\remsh.exe" C:\Windows\system32\svchost.exe -k netsvcs
11:56:47.3634292 remsh.exe 3076 4152 Process Create C:\Windows\system32\rundll32.exe SUCCESS PID: 1248,
Command line: C:\Windows\system32\rundll32.exe C:\Windows\system32\pnpclean.dll,RunDLL_PnpClean /DEVICES /DRIVERS /MAXCLEAN "C:\Program Files\rempl\remsh.exe"
11:56:47.3634539 rundll32.exe 1248 4152 Process Start SUCCESS Parent PID: 3076,
Command line: C:\Windows\system32\rundll32.exe C:\Windows\system32\pnpclean.dll,RunDLL_PnpClean /DEVICES /DRIVERS /MAXCLEAN
- The parent svchost.exe process is hosting the task scheduler service.
- The specific scheduled task that is run in this scenario is located in the following path:
Task Scheduler (Local) / Task Scheduler Library / Microsoft / Windows / rempl
This issue occurs because Windows receives an update reliability tool during a Windows Update installation of KB 4023057. The tool is designed to clean up the INF driver cache as part of its remediation procedures.
The applicability rules for the Windows update reliability tool have been improved. In addition, the latest version of this tool (10.0.14393.10020 or a later version) should not cause the issue.
As a workaround, you can completely block the update reliability tool from running. To do this, run the following commands:
takeown /f "C:\Program Files\rempl" /r /d yicacls "C:\Program Files\rempl" /grant administrators:F /t /qicacls "C:\Program Files\rempl" /deny system:F /t /q
Note The Windows update reliability tool is not published to WSUS servers.