Skip to content

Instantly share code, notes, and snippets.

@plembo
Last active July 14, 2023 00:26
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save plembo/c348342ed47064c49d9191ef86f7298c to your computer and use it in GitHub Desktop.
Save plembo/c348342ed47064c49d9191ef86f7298c to your computer and use it in GitHub Desktop.
Corrupted registry borks audio on Windows 10

Corrupted registry borks audio on Windows 10

WARNING: Proceed with caution, or at least in the presence of a former desktop engineer having 25 years or so of experience with Windows systems (like a Windows NT 3.51 era MCSE).

My son the game developer tried using a (very) old Logitech eyeball webcam on Windows 10 yesterday. After plugging it in he obediently rebooted when prompted by the O/S.

This, it turns out, was a mistake.

For the next couple of hours we struggled mightily with the system to get audio working again. Initially, Device Manager barked "Code 39" when we examined each audio device (Realtek HD, a USB mic and NVIDIA card audio). After several attempted re-installs and upgrades of drivers for each device (my erroneously diagnosing the problem as having to do with outdated Realtek audio drivers), he found a couple of links that provided a way out that didn't involve re-imaging the machine.

Windows Core Isolation

https://borncity.com/win/2018/07/06/windows-10-v1803-hcvi-causes-driver-error-code-39/

Windows Core Isolation (HCVI), is a new protective feature that shipped with version 1803. The fix is simple: disable it in the registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity]
"Enabled"=dword:00000001"

We disabled by changing the DWORD value from 1 to 0.

Once we made this change to his machine's registry and rebooted, Device Manager switched to showing a Code 19 error instead of Code 39.

Note: All my test VMs had a different key, CredentialGuard, and it was already set to 0.

Windows UpperFilters and LowerFilters

https://www.remooptimizer.com/delete-the-upper-filter-and-lower-filter-registry-value.html

As the article explains, Filters are the device driver "add-ons" that get installed to support using a device. Apparently the system is sometimes unable to correct for problems with applying these filters, ultimately resulting in corruption of the registry. So much for Plug and Play.

The fix is to remove references to these filters, which come in two equally vexing forms: UpperFilters and LowerFilters.

This article steps though the process best:

https://www.lifewire.com/how-to-delete-the-upperfilters-and-lowerfilters-registry-values-2619222

In order to do what needs to be done, we needed to find the registry key that matches the Class GUID for the affected device, as listed in this article:

https://www.lifewire.com/device-class-guids-for-most-common-types-of-hardware-2619208

In our case we were dealing with both audio devices and a scanner (our home HP MFP), which would be covered by the following GUIDs:

4D36E96C-E325-11CE-BFC1-08002BE10318 (Media devices)

6BDD1FC6-810F-11D0-BEC7-08002BE2092F (Camera and Scanner devices)

Armed with this information, we once again opened the registry and edited the key for by media devices (4D36E96C-E325-11CE-BFC1-08002BE10318) by deleting any UpperFilter and LowerFilter values in the key root:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\6BDD1FC6-810F-11D0-BEC7-08002BE2092F]
"Class"="MEDIA"
"UpperFilters"=hex(7):...

Then we repeated the operation with the key for scanners and cameras (6BDD1FC6-810F-11D0-BEC7-08002BE2092F).

Note: In the regedit gui the data for UpperFilters and LowerFilters may simply appear as "ksthunk". To delete, simply right click on the value name and select "Delete". My test VM did not have a LowerFilters value in either key.

After completing these tasks, we rebooted the system and voila! A clean Device Manager tree and everything worked again!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment