Article ID: 298102 - View products that this article applies to.
This article was previously published under Q298102
This article describes how to find the source of a pool tag that is used by a third-party driver. This may be useful because when you troubleshoot an issue, you may encounter a pool tag that cannot be tied to a Microsoft component, and finding the source of these tags can be complicated and is often impossible without the use of a kernel-mode debugger.
To find files that (potentially) use a given pool tag, use the Search tool in Windows 2000:
You can use the findstr command (in all versions of Windows) instead of Windows Explorer. To minimize the occurrence of false hits, change to the system root\drivers folder at a command prompt. If needed, use Windows Explorer to find this folder. Run the findstr /m /l tag *.sys command, where the /m switch is used to list only the file name. If you receive multiple files, try to reduce the amount of files returns by adding the letter "h" to the tag before you run the search. This is mainly useful when the tag is comprised of three letters.
Note You may find that this query may not find the appropriate driver because the driver is not loaded from %SYSTEMROOT%\drivers. In this case, run more global searches such as findstr /m /l tag *.sys that start from %SystemRoot%, %ProgramFiles%, %SystemDrive%, %ProgramData%. For examples, use the findstr /m /l hTCPt *.sys command to return Tcpip.sys and findstr /m /l hCPnp *.sys to return Classpnp.sys or Acpiec.sys depending on which operating system you are running.
For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:
(https://support.microsoft.com/kb/250453/ )Determining special pool tagging options when debugging
(https://support.microsoft.com/kb/177415/ )How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks
Article ID: 298102 - Last Review: March 1, 2007 - Revision: 5.2