question

frapc-2930 avatar image
0 Votes"
frapc-2930 asked frapc-2930 answered

desktop.ini periodically waking up secondary HDD

Hi, through Sysinternals Process Monitor I have noticed that the secondary HDD installed on my PC gets periodically (quite often) spun up by some activity done to the desktop.ini file contained in a couple of directories on that drive.

My PC has a primary (OS) SSD a secondary (data) HDD so while I understand that desktop.ini may be important for storing folder settings etc, I'd really like to have any activity on the secondary drive happen only when it's spun up because of me.
Is there any way to at least prevent this stuff from autonomously spinning up secondary non-OS drives? (To me the benefits would be much greater than any performance gain given by caching icons and stuff like that)

Thanks :)

windows-10-setupwindows-10-hardware-performance
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

TeemoTang-MSFT avatar image
0 Votes"
TeemoTang-MSFT answered

Hi,
Unfortunately, Windows automatically generates a desktop.ini file upon changes to a folder. This automatic generation cannot be turned off, as it is a part of the operating system programming. Windows puts them everywhere. Not a problem. Even the hidden ones you can delete safely.
For current situation, you may execute a full scan on your device, because desktop.ini can be exploited by viruses, malware and spyware. Also check your secondly HDD behavior is safe mode.
If the result of full scan is healthy, you need to do a deep research on what specific process/operation waking up the secondary HDD, there is a similar case can be regarded as a reference.
Desktop.ini generates folders in external drives - Windows 10 Support (bleepingcomputer.com)
https://www.bleepingcomputer.com/forums/t/734785/desktopini-generates-folders-in-external-drives/


If the Answer is helpful, please click "Accept Answer" and upvote it.
Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

frapc-2930 avatar image
0 Votes"
frapc-2930 answered TeemoTang-MSFT commented

@TeemoTang-MSFT thank you for your reply. After suddenly realizing I had to explicitly tell Malwarebytes which drives to scan, it has found something, so now I will keep an eye on what happens, and I will take into consideration your other suggestions.

For now I have noticed that desktop.ini is accessed when I go to a certain path on the drive, which is good. What I don't really want is any other background automated activity on the desktop.ini file(s) (and on anything else, but baby steps for now) that can wake up my secondary HDD from its spun-down state. Is there any way to prevent this sort of automated activity by Windows (supposing it was not a malware's fault) for that drive? Also, I have read online that some disk activity might be because of the File Explorer Libraries feature, could it be related to desktop.ini too?

Thanks for your time :)



EDIT - I have hust found desktop.ini activity from explorer.exe (FASTIO_QUERY_INFORMATION) waking my drive again. Sad.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

If you have a procmon trace, what executable is reading/writing the desktop.ini file? Is it the search service?

1 Vote 1 ·

From the logs I have saved it's mmc.exe but usually it's explorer.exe. I don't think I've seen the search service accessing it; I have indexing disabled for this drive and now the search service is disabled too. I can confirm this activity still wakes up my drive (I've updated my answer above)

0 Votes 0 ·

I see, if you have captured that desktop.ini activity from explorer.exe keep waking your secondary drive, I don't have other idea to prevent it, it might be a system programing phenomenon.

1 Vote 1 ·
frapc-2930 avatar image
0 Votes"
frapc-2930 answered

I have seen that desktop.ini on the secondary drive is accessed even when I open the Control Panel. Windows is installed on the primary drive, so there should not be ANY activity on the secondary drive if I don't access it.

May desktop.ini being accessed even when I open Control Panel be a symptom of some Windows setting that considers the secondary drive as involved in OS operations instead of just being mass storage? Is it possible to change this behaviour? The secondary drive should just sit there until I access something on it.

102370-open-control-panel.png


Thanks



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.