Log Dejargonizer

Windows System Log · Event 7026

Event 7026: A driver that loads at boot did not load

Windows keeps a list of drivers to load before anything else starts. This event names the ones on that list that were not there. On most home PCs it names a driver Windows itself retired, and the correct response is to do nothing at all.

Also written as Event ID 70267026 driver did not loadboot start driver failed

What it means for you

On a personal computer

A component Windows expected to load at startup was missing. If everything works — your PC boots, your devices work — this is almost certainly a leftover entry for something that no longer exists. The names look alarming because they are cryptic, not because they are serious.

For an analyst

Read the driver name against what the machine actually needs. Storage and filter drivers are worth chasing; the perennial cd-rom, cdrom and i8042prt entries on virtual machines are not. On servers, a missing filter driver from a security or backup product means that product is not actually protecting the machine even though its service is running, which is the case where this event is genuinely important.

The fields that decide it

Everything else in the log line is context.

Driver names
The list of drivers that failed to load. Everything hinges on which ones.
  • cdrom or cd-romThe optical drive driver on a machine with no optical drive. The single most common benign instance.
  • i8042prtThe PS/2 keyboard and mouse driver, absent on machines with only USB input.
  • Storage or filter drivers from a backup or security productThe product's kernel component is not loading, which usually means it is not doing its job.
  • A driver matching hardware you still useA genuine fault. Expect the device not to work.
  • Unfamiliar names not tied to installed softwareWorth identifying before dismissing — a service entry can outlive the file it pointed at.
Whether the hardware works
Not a field, but the deciding test. A missing driver for hardware that functions normally is a stale registry entry, not a fault.
Boot-start versus system-start
Boot-start drivers load before the kernel initialises devices and are usually storage-related; system-start drivers load slightly later. A boot-start failure that mattered would normally stop the machine booting at all.

Common questions

Event 7026 names cdrom. Should I fix it?

No. It means Windows had an entry for the optical drive driver and found no optical drive to attach it to, which is the normal state of most modern machines and every virtual machine. It has no effect on anything. This single entry accounts for a large share of all the 7026s people find when they go looking through Event Viewer.

How do I tell whether an Event 7026 driver matters?

Ask whether anything is broken. If the machine boots, every device works, and your software runs, a driver that did not load was not needed. If something specific is not working — a device missing from Device Manager, a security product reporting itself inactive — then match the driver name to that product and reinstall it.

Can I remove the leftover entry so the error stops?

You can, by deleting the corresponding service key under HKLM\SYSTEM\CurrentControlSet\Services, but it is rarely worth the risk. Deleting the wrong key under that path can leave a machine unbootable, and the reward is one fewer harmless line in a log nobody reads. Identifying the driver and leaving it alone is the better trade.

When is Event 7026 actually serious?

When it names a filter driver belonging to antivirus, EDR or backup software. Those products run a kernel component alongside a user-mode service, and the service starting does not mean the driver loaded. A 7026 naming that driver means the product is present but not intercepting anything, which is worse than it being absent because the console still reports it as installed.

Read next

Mentioned by

Vendor documentation

Last reviewed 6 September 2026