Display Driver Uninstaller (DDU) v18.1.0.0 causes GSOD in Safe Mode

[Almighty1]

DDU run as administrator, but in most case it will use the "system" credentials to do it's things.

Does it basically use TrustedInstaller?

Maybe this will fix things...
https://www.elevenforum.com/t/add-reset ... -11.21237/

No it use really "system" for *most* things.

I just looked through the DDU log, and it seems the access denied is mostly on the registry keys because as far as C:\ProgramData\Intel is concerned... If I am reading it correctly, the Access Denied is only on C:\ProgramData\Intel\GFXInstaller as seen below, that means it's really only the Intel GPU stuff so I can literally delete C:\ProgramData\Intel\GFXInstallerbefore reinstalling the Intel GPU Drivers as all other folders in C:\ProgramData\Intel appears to show Remaining folders found.

C:\ProgramData\Intel\GCC\gcc_svc_log_2025-03-30.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_log_2025-03-29.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_lace_log_2025-03-30.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_lace_log_2025-03-29.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GCC</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GFXInstaller\Installer\IntelGFX_20250329_113356_Install.log</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GFXInstaller\Bootstrapper\IntelGFX_Bootstrapper_20250329_113349.log</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller\Installer</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller\Bootstrapper</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller</Message>
</Event>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Couldn't find directories, access denied!01</Message>
<Values Separator=" : ">
<KvP>
<Key>
</Key>
<Value>C:\ProgramData\Intel\</Value>
</KvP>
</Values>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\DAL</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\DSA</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\iCLS Client</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Installer</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Intel Extreme Tuning Utility</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\IntelSGXPSW</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Logs</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Package Cache</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Uploader</Message>
</Warning>

[Wagnard]

Does it basically use TrustedInstaller?

Maybe this will fix things...
https://www.elevenforum.com/t/add-reset ... -11.21237/

No it use really "system" for *most* things.

I just looked through the DDU log, and it seems the access denied is mostly on the registry keys because as far as C:\ProgramData\Intel is concerned... If I am reading it correctly, the Access Denied is only on C:\ProgramData\Intel\GFXInstaller as seen below, that means it's really only the Intel GPU stuff so I can literally delete C:\ProgramData\Intel\GFXInstallerbefore reinstalling the Intel GPU Drivers as all other folders in C:\ProgramData\Intel appears to show Remaining folders found.

C:\ProgramData\Intel\GCC\gcc_svc_log_2025-03-30.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_log_2025-03-29.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_lace_log_2025-03-30.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_lace_log_2025-03-29.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GCC</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GFXInstaller\Installer\IntelGFX_20250329_113356_Install.log</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GFXInstaller\Bootstrapper\IntelGFX_Bootstrapper_20250329_113349.log</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller\Installer</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller\Bootstrapper</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller</Message>
</Event>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Couldn't find directories, access denied!01</Message>
<Values Separator=" : ">
<KvP>
<Key>
</Key>
<Value>C:\ProgramData\Intel\</Value>
</KvP>
</Values>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\DAL</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\DSA</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\iCLS Client</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Installer</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Intel Extreme Tuning Utility</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\IntelSGXPSW</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Logs</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Package Cache</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Uploader</Message>
</Warning>

It's possible. Also via DDU you can load the logs, it's easier to see it there.
But it's not clear in the logs exactly what is the issue. We know its either the Intel folder itself or the Gfx or even another one that could be listed because of the issue.

The warnings about the registry stuff are expected and is normal btw.

[Almighty1]

No it use really "system" for *most* things.

I just looked through the DDU log, and it seems the access denied is mostly on the registry keys because as far as C:\ProgramData\Intel is concerned... If I am reading it correctly, the Access Denied is only on C:\ProgramData\Intel\GFXInstaller as seen below, that means it's really only the Intel GPU stuff so I can literally delete C:\ProgramData\Intel\GFXInstallerbefore reinstalling the Intel GPU Drivers as all other folders in C:\ProgramData\Intel appears to show Remaining folders found.

C:\ProgramData\Intel\GCC\gcc_svc_log_2025-03-30.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_log_2025-03-29.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_lace_log_2025-03-30.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GCC\gcc_svc_lace_log_2025-03-29.txt</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GCC</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GFXInstaller\Installer\IntelGFX_20250329_113356_Install.log</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted file:
C:\ProgramData\Intel\GFXInstaller\Bootstrapper\IntelGFX_Bootstrapper_20250329_113349.log</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller\Installer</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller\Bootstrapper</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller</Message>
</Event>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Couldn't find directories, access denied!01</Message>
<Values Separator=" : ">
<KvP>
<Key>
</Key>
<Value>C:\ProgramData\Intel\</Value>
</KvP>
</Values>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\DAL</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\DSA</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\iCLS Client</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Installer</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Intel Extreme Tuning Utility</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\IntelSGXPSW</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Logs</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Package Cache</Message>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\Uploader</Message>
</Warning>

It's possible. Also via DDU you can load the logs, it's easier to see it there.
But it's not clear in the logs exactly what is the issue. We know its either the Intel folder itself or the Gfx or even another one that could be listed because of the issue.

The warnings about the registry stuff are expected and is normal btw.

I will try to use DDU to look at the logs but Notepad++ is easier for me to search for "access" which is really to search for "access denied". I just tried using DDU but how do you look at the older logs as it seems to only show the logs from when the current DDU session was opened.

Actually, this was what I observed. The problems would all say "access denied" which is with the registry obviously but also with
C:\ProgramData\Intel\GFXInstaller</Message>
</Event>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Couldn't find directories, access denied!01</Message>
<Values Separator=" : ">
<KvP>
<Key>
</Key>

which would indicate it is C:\ProgramData\Intel\GFXInstaller
since
<Key>
</Key>
<Value>C:\ProgramData\Intel\</Value>
</KvP>
</Values>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found :

with the "Remaining folders found" would already have indicated it is able to access everything else under C:\ProgramData\Intel
as there were no complaints so at this point as I am reindexing Windows which is a long process. I will attempt this again in a few days and basically do the following while offline:
1) Device Manager,
2) right click on the Intel GPU and select uninstall including deleting the driver files
3) reboot
I will repeat #1-#3 until it says Microsoft Basic Display Drivers and then delete C:\ProgramData\Intel\GFXInstaller afterwards, then run DDU in Safe Mode and provide the logs to see if it still complains with the access denied issue or not.

[Wagnard]

I think DDU was able to remove gfxinstaller according to the logs. It could.be an unlisted thing that ddu can't access.
Just renaming and creating the Intel folder in safemode may fix everything.

[Almighty1]

I think DDU was able to remove gfxinstaller according to the logs. It could.be an unlisted thing that ddu can't access.
Just renaming and creating the Intel folder in safemode may fix everything.

If you look at the logs, it seems to be doing the C:\ProgramData\Intel folder in alphabetical order:

C:\ProgramData\Intel\GFXInstaller\Bootstrapper</Message>
</Event>
<Event>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Deleted directory:
C:\ProgramData\Intel\GFXInstaller</Message>
</Event>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Couldn't find directories, access denied!01</Message>
<Values Separator=" : ">
<KvP>
<Key>
</Key>
<Value>C:\ProgramData\Intel\</Value>
</KvP>
</Values>
</Warning>
<Warning>
<Time>3/30/2025 5:12:32 PM</Time>
<Message>Remaining folders found : C:\ProgramData\Intel\ --&gt; C:\ProgramData\Intel\DAL</Message>
</Warning>

C:\ProgramData\Intel\GFXInstaller\Bootstrapper as you can see is fine and deleted, it complained right under C:\ProgramData\Intel\GFXInstaller</Message> with the <Message>Couldn't find directories, access denied!01</Message> which was the only access denied! message so either it's GFXInstaller itself or folder under GFXInstaller as it did not complain about the other folders inside C:\ProgramData\GFXInstaller since all of those says Remaining folders found.

How do you even look at a previous log with DDU as I just tried it and both the Extended log and the log on the main screen only shows the current session.

[Wagnard]

In extended, you have the option to open a log, bottom left

[Almighty1]

Thanks, event 1596 is the problem and on my system, the folders under C:\ProgramData\Intel are:
DAL which is covered by event 1597
DSA which is covered by event 1598
GCC which was deleted by event 1590
GFXInstaller which is successfully deleted in event 1595
iCLS Client which is covered by event 1599
Installer which is covered by event 1600
IntelSGXPSW which is covered by event 1602
Logs which is covered by event 1603
PackageCache which is covered by event 1604
Uploader which is covered by event 1605

I no longer have Intel Extreme Tuning Utility since that has been uninstalled a long time ago so I deleted it.
If C:\ProgramData\Intel itself was the problem, then it wouldn't be able to see the folders above and delete the ones that were deleted so unless there are hidden folders in C:\ProgramData\Intel and even with a privileged file manager using Right-Click tools running as TrustedInstaller which is the highest level of access, I do not see anything not mentioned above. I guess I can try copying the Intel from C:\ProgramData to the desktop and see if it complains or not. The first permission denied was Intel but clicking try again copied successfully, the IntelSGXPSW is the other one which try again does not work and can't get past it. What I then tried to do is manually copy each folder inside C:\ProgramData\Intel and all of them copied fine except for IntelSGXPSW as it would not even show who the current owner is and shows files and folders as 0 and size is 0 bytes so that's the problem folder which means I have uninstall SGX(Software Guard Extensions) first, delete the folder using the Privilege folder viewer and reinstall SGX. Only thing is there is no Intel SGX listed either in the SGX or full name in Add/Remove software and it appears that when browsing with trusted installer, the folder only has System and AESMService with permissions but SGX appears to be related to security built into the Intel CPUs so maybe that folder is supposed to be non-accessible. I will need to ask other people on elevenforums if they have access to that folder or not. Looks like reading the documentation that comes with SGX, the older versions used a .exe installer but the newer versions are INF installer based which requires using pnputil to install both a base.inf and a psw.inf file. I renamed the folder using the privilege file viewer and will use DriverStore Explorer to remove the existing base.inf and psw.inf from DriverStore and then install both using the pnputil instructions Intel provided in the documentation which I just did successfully and it recreated the same folder and it still has the same permissions as before with permissions denied only thing is the files inside are actually the current versions from the September 2024 current version and not the 2023 versions like before so that folder is supposed to be that way by design and only system has access to it other than the service.