Before the PnP manager sends an IRP_MN_REMOVE_DEVICE IRP to the drivers for a device, the PnP manager calls any kernel-mode notification callback routines that registered for EventCategoryTargetDeviceChange on the device. The PnP manager specifies a NotificationStructure.Event of GUID_TARGET_DEVICE_REMOVE_COMPLETE.

When handling a GUID_TARGET_DEVICE_REMOVE_COMPLETE event, a notification callback routine should:

  • Remove notification registration on the device.

    The device has been removed, so the driver calls IoUnregisterPlugPlayNotification to remove the notification registration.

    The device may still be physically present on the machine, but all device objects have been deleted and the device is not available for use.

  • Perform surprise-remove processing if the driver did not receive a previous query-remove notification.

    If a device is surprise-removed, the PnP manager sends registered drivers a remove-complete notification without a prior query-remove notification. In this case a driver has to perform any necessary cleanup, such as closing any handles to the device and removing any outstanding references to the file object.