driverquery: Enables an administrator to enumerate and display the list of installed device drivers as well as their properties.

Microsoft Windows [Version 10.0.19045.3693]
(c) Copyright 1985-2023 Microsoft Corp.

C:\\WINDOWS>


DRIVERQUERY [/S system [/U username [/P [password]]]]
              [/FO format] [/NH] [/SI] [/V] 
Description:
    Enables an administrator to enumerate and display the list of 
    installed device drivers as well as their properties.

Parameter List:
      /S     system           Specifies the remote system to connect to.

      /U     [domain\]user    Specifies the user context 
                              under which the command should execute.

      /P     [password]       Specify the Password for the given 
                              user context. Prompts for input if omitted.

      /FO    format           Specifies the type of output to display.
                              Valid values to be passed with the
                              switch are "TABLE", "LIST", "CSV".

      /NH                     Specifies that the "Column Header" 
                              should not be displayed in the
                              screen output. Valid for "TABLE" 
                              and "CSV" format only.

      /V                      Displays detailed information. Not valid 
                              for signed drivers.

      /SI                     Provides information about signed drivers.

      /?                      Displays this Help/Usage.

Examples:
    DRIVERQUERY
    DRIVERQUERY /FO CSV /SI
    DRIVERQUERY /NH
    DRIVERQUERY /S ipaddress /U user  /V 
    DRIVERQUERY /S system /U domain\user /P password /FO LIST

Here are some examples of the `DRIVERQUERY` command in the Windows Command Prompt with explanatory comments: Example 1: Show all installed drivers:

DRIVERQUERY

This command displays a list of all installed drivers on the system. Information such as the module name, display name, type, boot mode and status of the drivers are displayed. Example 2: Show detailed information for a specific driver:

DRIVERQUERY /V /FO LIST /FI "MODULE eq ntoskrnl.exe"

This command displays detailed information about the driver with the module name "ntoskrnl.exe". The `/V` options display detailed information, and `/FO LIST` formats the output as a list. Example 3: Save list of drivers to a text file:

DRIVERQUERY /FO TABLE > Driverlist.txt

Here the list of installed drivers is saved in a text file called "Driverlist.txt". The `/FO TABLE` option formats the output as a table. Example 4: Show only active drivers:

DRIVERQUERY /FO LIST /FI "STATUS eq Running"

This command displays a list of all active (running) drivers. The `/FI "STATUS eq Running"` option filters the drivers according to their status. Example 5: Filtering drivers by type:

DRIVERQUERY /FO LIST /FI "IMAGETYPE eq Kernel Mode Driver"

Only kernel mode drivers are shown here. The `/FI "IMAGETYPE eq Kernel Mode Driver"` option filters the drivers by their image type. Example 6: Export driver information as a CSV file:

DRIVERQUERY /FO CSV > driver information.csv

This command exports the driver information to a CSV file named "driverinformation.csv". This can be useful for further processing the data in spreadsheet programs. These examples are intended to give you an insight into how to use the `DRIVERQUERY` command to retrieve information about drivers on a Windows system. Note that administrative privileges may be required to access some driver information.

There are a few important points to note when dealing with the `DRIVERQUERY` command in the Windows Command Prompt: 1. Administrative Privileges: The `DRIVERQUERY` command displays detailed information about drivers that may require administrative permissions. Make sure you open Command Prompt with administrator privileges. 2. Different execution on different Windows versions: The supported options and output formatting may vary depending on the version of Windows. Make sure to check the documentation for your specific version of Windows. 3. Note filter and format options: The command supports various filtering and output formatting options (`/FI`, `/FO`). Consider the possible combinations and choose the ones that best suit your needs. 4. Understand Driver Status and Type: Understand the different status (`Running`, `Stopped`, etc.) and type options (`Kernel Mode Driver`, `File System Driver`, etc.) to effectively filter for drivers. 5. Interaction with other commands: `DRIVERQUERY` can be combined with other commands such as `FIND` or `FINDSTR` to further filter and search the output. This can be helpful if you are looking for specific information. 6. Save output to external files: You can save the output of `DRIVERQUERY` to external files for later reference or analysis. Make sure the file formats and options meet your needs. 7. Interpretation of Output: Understand the information that `DRIVERQUERY` provides. This includes information such as module name, display name, type, boot mode and status of the drivers. If necessary, consult the documentation for more specific details. 8. Potential System Changes: The command displays information about installed drivers. Be careful when taking actions based on this information, especially if you do not know exactly how changes may affect the system. 9. Use in scripts or automation: `DRIVERQUERY` can be used in scripts or automation tasks. Make sure you customize the options accordingly and understand all actions in the context in which they are performed. 10. Regular Driver Check: It can be helpful to run `DRIVERQUERY` at regular intervals to monitor changes to drivers and identify potential problems early. It is recommended to consult the official Microsoft documentation for the `DRIVERQUERY` command for detailed information and use cases specific to your version of Windows.