Can I determine which network driver was used when booting to WinPE from Ghost?

Question

I'm trying WinPE pre OS to boot laptops for ghost 11.5, and I need to set the NIC to 100_full for compatibility with the switch. I've found how to do this by modifying the inf files but there are multiple drivers which match the vendor ID of the laptop's NIC. Is there a way to determine which driver was (or will be) used by WinPE so that I only have to edit one inf file instead of all possible matches?

Solution

This is written assuming you mean Ghost Solution Suite 2.5, which is one of the two Symantec products containing the genuine Ghost imaging tools. Note that it's best to refer to the actual product, not the version of an executable within the product, because there are multiple products which use those executables and they don't necessarily have all the same pieces.

Anyway, while the format of Windows INF files is documented and well-known, the precise algorithm used by the PnP driver installation process to select the best possible match isn't easy to unwind, so determining precisely what will be selected from outside is difficult. It's best to boot up and look at the results.

Ghost Solution Suite 2.5 includes some different builds of Windows PE 2.0; one is very cut down to run on low-level machines, and doesn't include WMI. The other, more expansive build of Windows PE includes more drivers and also includes the WMI subsystem. However, although it includes WMI and includes Windows Script Host, it doesn't have the WMI scripting namespace provider installed, so while the normal way you'd do this is to use some script, that's not an easy option from within the GSS 2.5 build of WinPE.

That leaves the classic way of working this out, which is to boot the system and then inspect the registry to determine what the PNP installation process actually did. Boot WinPE and fire up RegEdit.EXE and you can inspect the results of the PNP enumeration process. The results of the raw enumeration are all inside HKLM\SYSTEM\CurrentControlSet\Enum\ - under those, the DeviceDesc value happens to list the specific INF file which was matched by the PNP hardware detection process, usually under the PCI subtree (but occasionally under other places; nVidia network adapters use a custom bus enumeration driver, for instance).

Other than trawling through the enumeration, you can then look at the classification by device class under HKLM\SYSTEM\CurrentControlSet\Control\Class where device classes are identified by GUID. The network GUID is easy to find, but interactively it's easiest to navigate to HKLM\SYSTEM\CurrentControlSet\Control\Class then search with Control-F looking for netcfgx which is the network driver's class installer. This should put you at the right class GUID, under which will be driver instance ID numbers. In those you should see all the driver information including a link to the path under the "Enum" tree and a value named InfPath which will (similarly to DeviceDesc) link to the specific matched INF used to install the network adapter and InfSection which identifies the right sub-path of a complex INF.

With practice once you get used to navigating the driver area of the registry you can easily use regedit to identify which INF and which specific part within it matches on a specific machine, given a particular WinPE driver load.

Comments

[Chris]

You're right, it is GSS 2.5; I should have mentioned. I hadn't thought about using the registry; that enabled me to find out which driver had loaded. I don't know why it loaded that driver, but at least I have a method for identifying which inf to modify. Thanks.