Log Dejargonizer

Windows System Log · Event 219

Event 219: A driver failed to load for a device

Windows tried to load a driver for a piece of hardware and could not. Often harmless — a leftover entry for a device that is no longer plugged in — but it is also what a genuinely broken device looks like, and occasionally what blocked malware looks like.

Also written as Event ID 219Kernel-PnP 219driver load failure 219

What it means for you

On a personal computer

Windows could not start the software for a piece of hardware. If everything still works, it is usually a leftover entry for something you unplugged. If a device stopped working, this is probably why.

For an analyst

Also fires when driver signature enforcement or an allow-list blocks a load, which is worth distinguishing from a missing file. An unfamiliar driver name failing to load can be the tail of a blocked vulnerable-driver attempt — check the path and signature before dismissing it.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The driver \Driver\WudfRd failed to load for the device SWD\WPDBUSENUM\{00000000-0000-0000-0000-000000000000}.

The fields that decide it

Everything else in the log line is context.

Driver name
Which driver failed, written as \Driver\Name. Check it against drivers you recognise.
Device instance path
The hardware it was for. Useful for identifying whether the device is even still present.
Status
The failure reason, as an NT status code. Distinguishes a missing file from a blocked or corrupt one.

Ordinary reasons this happens

Most of the time it is one of these.

  • A leftover registration for hardware that has been removed.
  • A driver replaced during an update, leaving the old entry briefly failing.
  • Virtual or optional devices that are not present in this configuration.
  • A partially completed driver uninstall.
  • Devices disabled deliberately in Device Manager.

When it is not ordinary

A vulnerable or malicious driver blocked from loading.

What gives it awayAn unfamiliar driver name, particularly one loading from a temporary or user directory rather than from the Windows driver store.

ATT&CK T1547.006

Tampering with a security product's kernel component.

What gives it awayA security vendor's driver failing to load, which leaves the product degraded or blind.

ATT&CK T1562.001

What to do next

  1. Check whether anything actually stopped working. If not, this is usually cosmetic.
  2. Look at the driver name and decide whether you recognise it.
  3. Check Device Manager for a device showing an error, and whether it is still physically present.
  4. For an unfamiliar driver, find the file, check where it lives and whether it is signed.
  5. If a security product's driver is failing, treat that as a coverage gap and fix it as a priority.
  6. Update or reinstall the driver from the vendor rather than letting Windows pick a generic one.

Queries to run

powershell 
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-PnP'} -MaxEvents 50 | Select-Object TimeCreated, Id, Message | Format-List
powershell Devices currently in a bad state. Matching one of these to the event tells you whether it matters. 
Get-PnpDevice | Where-Object { $_.Status -ne 'OK' } | Select-Object Status, Class, FriendlyName, InstanceId

Common questions

Is Event 219 anything to worry about?

Usually not. The most common cause is a leftover registration for hardware that is no longer connected, and Windows keeps trying anyway. It matters when a device has genuinely stopped working, or when the driver name is one you do not recognise.

How do I find which device Event 219 refers to?

The message includes a device instance path. Match it in Device Manager with View, Devices by connection, and Show hidden devices — hidden entries are exactly where removed hardware lives, which is usually the answer.

Can Event 219 indicate malware?

Occasionally. Attackers load vulnerable signed drivers to gain kernel access, and a blocked attempt can surface here. What to look at is the driver path and signature: a driver loading from a temporary or user profile directory rather than the Windows driver store is worth investigating properly.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026