Driver Locked

Question

I would like to know the following things.

1. What is exactly "Driver locked"?
2. What process does this happen by, when the memory increased with "Driver locked"?
3. In case of "Driver locked" occurred with memory increase and decrease, does this case is normal action as the system?
4. Is there the case that the memory is going to be "0" by "Driver locked" occurred?

It would be appreciated if you could reply those question.

Answer 1

Hi

Driver locked memory is when a kernel driver prevents memory from being wrote to the page file.

To find it I would suggest to read the answer there; https://superuser.com/questions/1121714/driver-locked-memory-on-a-non-virtual-machine

I will quote the answer, in case the link goes down in times;

Open Windows Assessment Console (WAC) from the Start menu.

Open the Options menu and select New Job…

Enter MemoryTest as the job name.

Select Create a custom job.

Click on Add Assessments.

Add the Memory Footprint assessment by clicking on the “+” symbol Click on the newly added Memory Footprint assessment to enter the test configuration.



Run the job directly on the system. (Click on the Run button in the bottom right corner to choose this option.)

    This restarts the system to gather a trace.

    This test can take some 15-20 minutes to complete.

After the trace was captured you gave to look at the data.

    In WAC, open the Options menu and select Open Results…
    Click on the Browse… button.
    Navigate to the folder where you stored the assessment you created in Step 1.
    Open the assessment you created in Step 1.

Here you see something like this:

Now Expand the Driver Non-Paged Allocations category by clicking on the arrow on the left.

Expand the DriverLockedSystemPages category:

Here a genric graphic driver was the cause. Look which driver is it for your case. Look for the driver properties/version and loo kif you get an updated driver.

In hope it explain the drivers locked value.

In IoT it can be like a write filter driver like the HP's one that could cause such, or driver to prevent usage/wearing of the SSD, but only an analyst will find the real driver that cause that.

Answer 2