I've always had this problem with one of my Toshiba external drives. I value that drive really high because of its built-in shock detector, what is currently very hard to find. But the cannot-remove-it-safely issue was driving me crazy.
Today, I've hit this question/thread on social-technet MS site. While there's a lot of noise down there, they point out a few common issues. Like the Distributed-Tracking service. It's actually hard to read through it all due to some cohones-size-flame-war that escalated at some point, but reading the topic from its end helps;)
Anyways, sorry for my chatty mood, I've just fixed my case permanently.
I've got any Distributed-Tracking/Windows-Search/etc services off and was still unable to safely-unplug the drive. Someone somewhere suggested that "quick removal" is the culprit, but almost all my USB drives run on it and I still can remove them safely.
However, I actually tried switching this drive to "high performance mode" and .. it caused the TxfLogContainerXXXX handles to evaporate. So, it's true that this is the quick-removal option. However, this did not released my drive yet. Still couldn't eject it.
Then I have went to ComputerManagement->DriveManagement utility and I have removed any drive-letter assignements for that drive. Instantly afterwards, I was able to eject the drive.
Then I tried connecting it again, reassigning the drive letter, switching it to quick-removal and it seems to work properly and still be ejectable.
On the so-long topic on MS site, they also mention these actions. Someone suggested to:
- change drive letters and reboot
- or, try turning the drive "offline"
I think that the "turn the drive offline" via "computer management -> drive management" might actually be the quickest solution, however I have not tried it since my random attempts helped before I've read about that.
Most likely a problem in the Keys:
HKLM\SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}
LowerFilters
, UpperFilters
value.
and as variant:
mountpoint:
mountvol /L | find "\\"
mountpoint, registry:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
remove unwanted entries mount points:
USB ID device:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
Windows XP:
backup registry and run:
usbrest.cmd:
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}" /v LowerFilters /f
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}" /v UpperFilters /f
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}" /v LowerFilters /f
del /F /A:- %windir%\inf\INFCACHE.1
sc config stisvc start= auto
sc start stisvc
sc config ShellHWDetection start= auto
sc start ShellHWDetection
need reboot.
usbdevice-delete-all.cmd:
REG DELETE "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB" /f
REG DELETE "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR" /f
delete all USB at device:
psexec -i -d -s usbdevice-delete-all.cmd
need reboot.
Run in cmd
, getusb-file.cmd
getusb-file.cmd:
dir /B /A:- %windir%\system32\Drivers\usb*
dir /B /A:- %windir%\inf\usb* | find /i ".inf"
Run in cmd
get UpperFilters disk device:
REG QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}" /v UpperFilters
Run in cmd
, get systemboard info:
wmic BASEBOARD get Product, SerialNumber, Version, Manufacturer
Output:
Manufacturer Product SerialNumber Version
ASUSTeK Computer INC. P5Q MS1C8CBKC500124 Rev 1.xx
RestoreServiceSetting.cmd:
::HID Input Service
sc config HidServ start= auto
sc start HidServ
::Shell Hardware Detection
sc config ShellHWDetection start= auto
sc start ShellHWDetection
::Windows Image Acquisition (WIA)
sc config stisvc start= auto
sc start stisvc
::Windows Management Instrumentation
sc config winmgmt start= auto
sc start winmgmt
::Remote Registry
sc config RemoteRegistry start= auto
sc start RemoteRegistry
::Logical Disk Manager
sc config dmserver start= auto
sc start dmserver
::Logical Disk Manager Administrative Service
sc config dmadmin start= demand
usbrest2.cmd:
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}" /v UpperFilters /t REG_MULTI_SZ /d PartMgr\0 /f
Disables automatic mounting of new volumes:
mountvol /N
Re-enables automatic mounting of new volumes:
mountvol /E
Restore default registry and filesystem settings:
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose
secedit /configure /cfg %windir%\repair\secDC.inf /db secDC.sdb /verbose
See eventlog disk event:
powershell Get-Eventlog system -Source Disk
See 10 last disk error:
powershell Get-Eventlog system -newest 10 -EntryType Error -Source Disk
Best Answer
As explained by Rook in this answer: https://superuser.com/a/674255/142560
To safely remove the drive:
diskpart
.list disk
.select disk [number here]
.offline disk
.You should be able to remove it now.
Next time you plug it in, it won't be automatically mounted. So either use the command prompt again to make it online, or: