Log Dejargonizer

Windows System Log · Event 11

Event 11: The driver detected a controller error

Windows could not talk to a drive properly — a command to it failed or timed out at the bus level. Unlike a bad-sector warning, this blames the path to the disk: the cable, the port, the enclosure, or the driver. On most home PCs it is a USB device, not the drive Windows is installed on.

Also written as Event ID 11 diskdisk 11 controller errorDevice Harddisk DR error

What it means for you

On a personal computer

The overwhelming majority of these come from something plugged into a USB port — an external drive, a card reader, a phone in file-transfer mode, or a hub that cannot supply enough power. Windows records it as a disk error because to Windows a USB stick is a disk. If it appears every time you unplug something without ejecting it first, that is the whole explanation.

For an analyst

In virtual machines this is frequently a storage-path artefact rather than a hardware fault — SAN path flaps, snapshot stun, and thin-provisioned datastores under pressure all produce it. On physical hosts, treat a rising count against a fixed \Device\HarddiskN as a cabling, backplane, or HBA firmware issue before you condemn the drive, and confirm against the drive's own SMART data rather than against this event.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Log Name:      System
Source:        disk
Event ID:      11
Level:         Error
Computer:      DESKTOP-WKS042

The driver detected a controller error on \Device\Harddisk2\DR2.

The fields that decide it

Everything else in the log line is context.

\Device\HarddiskN\DRn
The device path. The number after 'Harddisk' is the disk index Windows assigned; the number after 'DR' is an internal device object number and is not a reliable identifier. They often match, and when they do not, trust the Harddisk number.
  • \Device\Harddisk0\DR0Usually the boot disk. Repeated errors here are the ones that matter most.
  • A Harddisk number higher than your installed drive countA removable device. Almost always USB.
Level
Always Error, which overstates it. A single Event 11 caused by yanking a USB stick is logged at exactly the same level as a failing boot drive.
Binary data
The event carries a raw SCSI request block in its Details tab. It is rarely worth decoding by hand, but its presence is how you tell a genuine device response from a timeout — a timeout carries a largely empty block.
Timestamp
The most useful field on this event, because correlating it against when you plugged something in, started a backup, or woke the machine identifies the device far more reliably than the device path does.

Ordinary reasons this happens

Most of the time it is one of these.

  • A USB drive, SD card, or phone removed without using 'Safely Remove Hardware'. This is the single most common cause and it is harmless.
  • An external drive going to sleep and being woken by a scan or an indexer, which the controller reports as a failed command.
  • An unpowered USB hub with more devices on it than it can supply current for.
  • A card reader with no card in it, which some readers report as a disk that failed to answer.
  • In a virtual machine, a brief storage path failover or a snapshot operation that stalled I/O for longer than the guest's timeout.

When it is not ordinary

Firmware or storage-level tampering, which is rare and usually accompanied by much louder symptoms.

What gives it awayErrors against a disk that has no removable media and no recent hardware change, alongside unexplained boot failures or a modified boot configuration.

ATT&CK T1542.003

Destructive wiping tooling issuing raw device writes.

What gives it awayA burst of controller errors against a data volume alongside Sysmon RawAccessRead activity or an unfamiliar process holding a handle to \\.\PhysicalDrive.

ATT&CK T1561.001

What to do next

  1. Count them and look at the spread of device paths. One path repeating is a device problem; many different paths is usually a controller, driver, or power problem.
  2. Map the Harddisk number to a real drive: `Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, MediaType, HealthStatus` — DeviceId is the same number as the N in \Device\HarddiskN.
  3. If the number does not appear in that list, the device is gone, which means it was removable. That closes most home cases immediately.
  4. If it maps to an internal drive, read its SMART data before anything else. This event does not tell you the drive is dying; SMART reallocated-sector and pending-sector counts will.
  5. Reseat the data and power cables, and try a different SATA port or M.2 slot. Bus-level errors are cable and connector faults far more often than they are drive faults.
  6. Check the storage controller driver version. A generic Microsoft AHCI driver on a board that shipped with a vendor RAID driver is a common source, as is the reverse after a Windows feature update.
  7. Back up first if the path maps to a drive holding anything you care about. Every other step is safer once that is done.

Queries to run

powershell The device path is in the rendered message rather than in a named field, so the message is what you read. 
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='disk'; Id=11} -MaxEvents 100 | Select-Object TimeCreated, Message
powershell Maps the Harddisk number in the event to an actual drive. Run it while the device is still connected. 
Get-PhysicalDisk | Select-Object DeviceId, FriendlyName, MediaType, HealthStatus, OperationalStatus
powershell Windows' own view of drive reliability. Thinner than a full SMART dump but available without extra tools. 
Get-StorageReliabilityCounter -PhysicalDisk (Get-PhysicalDisk -DeviceNumber 0) | Select-Object Wear, ReadErrorsTotal, WriteErrorsTotal, Temperature
wevtutil Pulls the three disk-provider events together so you can see whether the bus errors and the media errors name the same drive. 
wevtutil qe System "/q:*[System[Provider[@Name='disk'] and (EventID=11 or EventID=7 or EventID=153)]]" /c:40 /rd:true /f:text

Common questions

Is Event 11 'the driver detected a controller error' serious?

It depends entirely on which device it names. If the Harddisk number belongs to a USB stick or external drive you unplugged, it is noise and you can ignore it. If it names an internal drive — especially Harddisk0 — and it repeats without you touching any hardware, treat it as a warning that the connection to that drive is unreliable and back it up now.

What does the DR number in \Device\Harddisk1\DR1 mean?

DR is an internal device object name Windows assigns, and its number is not a stable identifier for a physical drive. It usually matches the Harddisk number but does not always, and it can change between boots. Use the Harddisk number and match it against DeviceId from `Get-PhysicalDisk`; ignore the DR number.

Does Event 11 mean my hard drive is failing?

Not by itself. Event 11 is reported when a command to the drive fails or times out, which is at least as often a cable, port, enclosure, power, or driver problem as it is a dying drive. Check the drive's SMART data — a drive that is genuinely failing will normally also be producing Event 7 (bad block) or Event 153 (retried I/O), and its reallocated-sector count will be climbing.

Why does Event 11 appear when I unplug a USB drive?

Because Windows treats removable storage as a disk. Pulling a device out mid-transaction means an outstanding command never gets an answer, and the driver reports that as a controller error. Using 'Safely Remove Hardware' lets Windows finish and dismount the device first, which stops the event appearing.

Read next

Mentioned by

Vendor documentation

Last reviewed 7 September 2026