Use this report as a high-signal triage view to catch machines where core drivers that should start automatically aren’t actually running. You can quickly spot endpoints with potential protection gaps or stability risks, then prioritize remediation. With per-device and per-driver context at hand, you can decide whether to re-enable, reinstall, roll back, or investigate for misconfiguration, signing issues, or adversarial interference, grouped by domain and asset to streamline follow-up and reporting. You can find more info on this use case in Pro Tips 74.
Run the Auto/Boot System Drivers Not Running Now!
SELECT TOP 1000000
a.AssetID,
a.AssetName,
a.Domain,
Coalesce(os.Image, [at].AssetTypeIcon10) AS [icon],
a.IPAddress,
os.OSname AS OS,
a.Version,
sdu.Caption,
sdu.Name,
sd.State,
sd.StartMode,
sd.ServiceType,
sd.PathName,
ac.Manufacturer,
ac.Model,
sd.LastChanged,
a.Lastseen AS [Last successful scan],
a.Lasttried AS [Last scan attempt]
FROM tblAssets a
LEFT JOIN tblAssetCustom ac ON ac.AssetID = a.AssetID
JOIN tblSystemDrivers sd ON a.AssetID = sd.AssetID
JOIN tblSystemDriversUni sdu ON sd.SystemDriverUniID = sdu.SystemDriverUniID
LEFT JOIN tsysAssetTypes [at] ON [at].AssetType = a.Assettype
LEFT JOIN tsysIPLocations ipl ON a.IPAddress = ipl.IPLocation
LEFT JOIN tsysOS os ON os.OScode = a.OScode
LEFT JOIN tblState st ON st.State = ac.State
WHERE LOWER(st.Statename) = 'active' and StartMode IN ('Boot','System','Auto') and sd.State Not in ('Running') and sd.LastChanged > GetDate() - 7 and sdu.Name Not in ('WdBoot','hwpolicy','dam')
ORDER BY a.Domain, a.AssetName, sdu.Caption
Explore the full platform, free for 14 days.
No credit card required.