Drivers being deleted by something in Windows 7  

I do it for PCI compliance that states that you must have a way of updating all software affecting the credit card environment. I have 50 terminals that need updating and believe it or not, Windows miss updates sometimes especially a new build that needs updates. I do let windows process most updates but for a network I find it much easier to have LanGuard do it. Plus it updates about 100 programs that Windows does not touch. It keeps my systems as secure as possible.

No sweat. I can fix many things but this has me stumped. Oh well, if all else fails, do a fresh install but I hate to do it.

OK,
lets try this

Use method 2 see KB 2500967.

Roy

Yea, thought about doing that but I think I will follow your advice and do it tomorrow. I will post back what happens. Thanks again.

I don't know if this will help but might add a clue.. Windows traces Device Manager install and uninstalls when they occur. The device is (probably) being uninstalled so am hoping for a trace. That would give you a date/time stamp to check against the LanGuard log to see if it's doing something at that time

It'll be a large file. Let's save current data. Rename C:\Windows\inf\setupapi.dev.log to setupapi.dev.log.old. Wait for the problem to happen again. Windows will write a new file. Look in the log for the word Uninstall. And post the new log file

fyi.. When I manually un-install the Generic monitor driver, I have an uninstall trace log entry as shown below. Hope you have a similar entry that starts Device Uninstall for your monitor device driver.

Code:

>>>  [Device Uninstall (Device Manager) - DISPLAY\SAM0945\5&2814FC75&0&UID1048849]
>>>  Section start 2015/09/28 20:02:55.678
      20:02:55.678 cmd: "C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
     dvi: 20:02:55.679 {DIF_REMOVE}
     dvi: 20:02:55.680      Looking for class installer for 'Generic PnP Monitor'...
     dvi: 20:02:55.681      Using exported function 'MonitorClassInstaller' in module 'C:\Windows\system32\Montr_CI.dll'.
     dvi: 20:02:55.682      Class installer == Montr_CI.dll,MonitorClassInstaller
     dvi: 20:02:55.682      Looking for co-installer modules for 'Generic PnP Monitor'.
     dvi: 20:02:55.683      No CoInstallers found
     dvi: 20:02:55.683      Class installer: Enter
     dvi: 20:02:55.684      Class installer: Exit
     dvi: 20:02:55.685      Default installer: Enter
     dvi: 20:02:55.685           {Remove DEVICE}
     dvi: 20:02:55.686                InstanceID = 'DISPLAY\SAM0945\5&2814FC75&0&UID1048849'
     dvi: 20:02:55.686                Devnode Status = 0x0180600a
     dvi: 20:02:55.698                CM_Query_And_Remove_Subtree_Ex returns 0x00000000
     dvi: 20:02:55.701                Devnode Status after CM_Query_And_Remove_Subtree_Ex = 0x01806400
     dvi: 20:02:55.701                Query-and-Remove succeeded
     dvi: 20:02:55.702                {Delete DEVICE}
     dvi: 20:02:55.717                     Device Instance uninstalled.
     dvi: 20:02:55.718                {Delete DEVICE exit (0x00000000)}
     dvi: 20:02:55.719           {Remove DEVICE exit (0x00000000)}
     dvi: 20:02:55.720      Default installer: Exit
     dvi: 20:02:55.720 {DIF_REMOVE - exit(0x00000000)}
<<<  Section end 2015/09/28 20:02:55.720
<<<  [Exit status: SUCCESS]

I will get those logs and post as soon as I have them thanks!

OK I am forgetting to get that log before the employee comes in and I will write myself a note and do it tomorrow. Anyway, I have new wrinkle. The person came in and and the driver was uninstalled. I went to install the driver again and it told me access denied. I used an admin account so I should not be blocked out. There are no group policies preventing me from installing drivers. So it would not install so I rebooted the computer and the driver was back in place and the monitor was working correctly. Any thoughts on that one? It's starting to get annoying.

Did you rename the old log file? Zip a copy of the old log you renamed as well as the current C:\Windows\inf\setupapi.dev.log. Don't know that the log files will have the answers but is worth a look to see if anything jumps out