Guide | How To How to ACTUALLY safely remove ext HDD/USB in Win Vista & later

The associated guide may contain user-generated or external content.

Myna

Level 10
Thread author
Verified
Jan 16, 2014
452
If you have a USB device connected to a computer running Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2, and you then Disable the device in Device Manager, or Safely Remove the device using the system tray icon, you may observe one of the following symptoms:
  • The USB device shows continued indications of activity (such as an LED that remains illuminated).
  • The USB device continues to receive USB packets and continues to consume power corresponding to an active device state.
  • Physically disconnecting the Disabled or Safely Removed USB device may, in some cases, cause an error in an active transfer to a different USB device.
These symptoms are not observed on a computer running Windows XP or Windows Server 2003 under similar conditions.

CAUSE
When a USB device is Disabled in Device Manager or Safely Removed using the system tray icon, a Remove Device request (PnP IRP IRP_MN_REMOVE_DEVICE) is issued to perform a "Soft Removal" of the USB device. The USB device is marked as Removed for Plug and Play purposes, although the device has not been physically disconnected yet.

In Windows XP and Windows Server 2003, when a USB device is marked as Removed, the USB hub port to which it is connected is Disabled. When the port is Disabled, no further USB traffic is sent to the device.

In Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, when a USB device is marked as Removed, the USB hub port to which it is connected is not Disabled. When the USB hub port remains Enabled after the USB device is marked as Removed, the Symptoms described above may occur.

RESOLUTION
To work around this problem, a registry value can be set to cause Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 to revert to the Windows XP and Windows Server 2003 behavior of disabling the USB hub port to which a Soft Removed USB device is attached. This workaround can be applied on a per-device basis (for all instances of a specific device (Vendor ID, Product ID, and Revision), or globally (for all enumerated USB devices).

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs.

Per-Device Setting
To apply the workaround for a specific device, add a REG_DWORD value named DisableOnSoftRemove that has a value of 1 to the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\usbflags\vvvvpppprrrr
(where vvvv is the device's Vendor ID, pppp is the device's Product ID, and rrrr is the device's Revision number).
  1. Click Start, click Run, type regedit in the Open box, and then click OK .
  2. Locate and then click the following subkey in the registry:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\UsbFlags
  3. On the Edit menu, point to New, and then click Key.
  4. Type the name of the new key in the following form:
    vvvvpppprrrr
    where vvvv is a 4-digit hexadecimal number that identifies the vendor (idDevice from the USB Device Descriptor),
    pppp is a 4-digit hexadecimal number that identifies the product (idVendor from the USB Device Descriptor), and
    rrrr is a 4-digit binary-coded decimal number that contains the revision number of the device (bcdDevice from the USB Device Descriptor).
  5. On the Edit menu, point to New, and then click DWORD (32-bit) Value.
  6. Type DisableOnSoftRemove for the name of the DWORD Value, and then press ENTER.
  7. Right-click DisableOnSoftRemove, and then click Modify.
  8. In the Value data box, type 1 , and then click OK.
  9. Exit Registry Editor.
Global Setting
To apply the workaround globally for all enumerated USB devices, add a REG_DWORD value named DisableOnSoftRemove that has a value of 1 to the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhub\HubG
  1. Click Start, click Run, type regedit in the Open box, and then click OK .
  2. Locate and then click the following subkey in the registry:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhub
  3. On the Edit menu, point to New, and then click Key.
  4. Type HubG for the name of the new key, and then press ENTER.
  5. On the Edit menu, point to New, and then click DWORD (32-bit) Value.
  6. Type DisableOnSoftRemove for the name of the DWORD Value, and then press ENTER.
  7. Right-click DisableOnSoftRemove, and then click Modify.
  8. In the Value data box, type 1 , and then click OK.
  9. Exit Registry Editor.

APPLIES TO

  • Windows Vista Ultimate
  • Windows Vista Ultimate 64-bit Edition
  • Windows Vista Enterprise
  • Windows Vista Enterprise 64-bit Edition
  • Windows Vista Business
  • Windows Vista Business 64-bit Edition
  • Windows Vista Home Premium
  • Windows Vista Home Premium 64-bit Edition
  • Windows Vista Home Basic
  • Windows Vista Home Basic 64-bit Edition
  • Windows Server 2008 Standard
  • Windows Server 2008 Enterprise
  • Windows Server 2008 Datacenter
  • Windows Server 2008 Service Pack 2
  • Windows 7 Ultimate
  • Windows 7 Enterprise
  • Windows 7 Professional
  • Windows 7 Home Premium
  • Windows 7 Home Basic
  • Windows Server 2008 R2 Standard
  • Windows Server 2008 R2 Enterprise
  • Windows Server 2008 R2 Datacenter
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top