I’m trying to let my secondary drive sleep most of the time, as it’s not being used and it makes a lot of noise and heat.
If I set Process Monitor to run with a filter to include access to this drive (F:) it keeps showing:
18:00:08.8821058 cmdagent.exe 300 IRP_MJ_CREATE F:\ SUCCESS Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, Impersonating: Ste-PC\Steve, OpenResult: Opened
18:00:08.8821456 cmdagent.exe 300 IRP_MJ_QUERY_INFORMATION F:\ SUCCESS Type: QueryNameInformationFile, Name: \
18:00:08.8821668 cmdagent.exe 300 IRP_MJ_QUERY_VOLUME_INFORMATION F:\ SUCCESS Type: QueryAttributeInformationVolume, FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00000, MaximumComponentNameLength: 255, FileSystemName: NTFS
18:00:08.8821873 cmdagent.exe 300 IRP_MJ_CLEANUP F:\ SUCCESS
18:00:08.8822096 cmdagent.exe 300 IRP_MJ_CLOSE F:\ SUCCESS
18:00:13.8893574 cmdagent.exe 300 IRP_MJ_CREATE F:\ SUCCESS Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, Impersonating: Ste-PC\Steve, OpenResult: Opened
18:00:13.8893947 cmdagent.exe 300 IRP_MJ_QUERY_INFORMATION F:\ SUCCESS Type: QueryNameInformationFile, Name: \
18:00:13.8894155 cmdagent.exe 300 IRP_MJ_QUERY_VOLUME_INFORMATION F:\ SUCCESS Type: QueryAttributeInformationVolume, FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00000, MaximumComponentNameLength: 255, FileSystemName: NTFS
18:00:13.8894349 cmdagent.exe 300 IRP_MJ_CLEANUP F:\ SUCCESS
18:00:13.8894561 cmdagent.exe 300 IRP_MJ_CLOSE F:\ SUCCESS
18:00:18.8902150 cmdagent.exe 300 IRP_MJ_CREATE F:\ SUCCESS Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, Impersonating: Ste-PC\Steve, OpenResult: Opened
18:00:18.8902515 cmdagent.exe 300 IRP_MJ_QUERY_INFORMATION F:\ SUCCESS Type: QueryNameInformationFile, Name: \
18:00:18.8902713 cmdagent.exe 300 IRP_MJ_QUERY_VOLUME_INFORMATION F:\ SUCCESS Type: QueryAttributeInformationVolume, FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00000, MaximumComponentNameLength: 255, FileSystemName: NTFS
18:00:18.8902907 cmdagent.exe 300 IRP_MJ_CLEANUP F:\ SUCCESS
18:00:18.8903119 cmdagent.exe 300 IRP_MJ_CLOSE F:\ SUCCESS
every 5s but that doesn’t seem to be waking it, but then sometimes I see
18:07:57.6123854 cmdagent.exe 300 IRP_MJ_CREATE F:\ SUCCESS Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, Impersonating: Ste-PC\Steve, OpenResult: Opened
18:07:57.6124242 cmdagent.exe 300 IRP_MJ_QUERY_INFORMATION F:\ SUCCESS Type: QueryNameInformationFile, Name: \
18:07:57.6124454 cmdagent.exe 300 IRP_MJ_QUERY_VOLUME_INFORMATION F:\ SUCCESS Type: QueryAttributeInformationVolume, FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00000, MaximumComponentNameLength: 255, FileSystemName: NTFS
18:07:57.6124677 cmdagent.exe 300 IRP_MJ_CLEANUP F:\ SUCCESS
18:07:57.6124908 cmdagent.exe 300 IRP_MJ_CLOSE F:\ SUCCESS
18:08:00.9972619 svchost.exe 888 IRP_MJ_CREATE F: SUCCESS Desired Access: Read Attributes, Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\SYSTEM, OpenResult: Opened
18:08:00.9973288 svchost.exe 888 IRP_MJ_QUERY_VOLUME_INFORMATION F: BUFFER OVERFLOW Type: QueryInformationVolume, VolumeCreationTime: 26/06/2013 18:46:29, VolumeSerialNumber: A622-1537, SupportsObjects: True, VolumeLabel: 2ndņ
18:08:00.9973756 svchost.exe 888 IRP_MJ_CREATE F:\ SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\SYSTEM, OpenResult: Opened
18:08:00.9974170 svchost.exe 888 IRP_MJ_SET_INFORMATION F:\ SUCCESS Type: SetBasicInformationFile, CreationTime: 01/01/1601 00:59:59, LastAccessTime: 01/01/1601 00:59:59, LastWriteTime: 01/01/1601 00:59:59, ChangeTime: 01/01/1601 00:59:59, FileAttributes: n/a
18:08:00.9974477 svchost.exe 888 IRP_MJ_FILE_SYSTEM_CONTROL F: SUCCESS Control: FSCTL_FILE_PREFETCH
18:08:00.9974872 svchost.exe 888 IRP_MJ_READ F:\$Mft SUCCESS Offset: 16,384, Length: 65,536, I/O Flags: Non-cached, Paging I/O, Priority: Very Low
18:08:02.6179687 cmdagent.exe 300 IRP_MJ_CREATE F:\ SUCCESS Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, Impersonating: Ste-PC\Steve, OpenResult: Opened
18:08:02.6180097 cmdagent.exe 300 IRP_MJ_QUERY_INFORMATION F:\ SUCCESS Type: QueryNameInformationFile, Name: \
18:08:02.6180312 cmdagent.exe 300 IRP_MJ_QUERY_VOLUME_INFORMATION F:\ SUCCESS Type: QueryAttributeInformationVolume, FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00000, MaximumComponentNameLength: 255, FileSystemName: NTFS
18:08:02.6180543 cmdagent.exe 300 IRP_MJ_CLEANUP F:\ SUCCESS
18:08:02.6189916 cmdagent.exe 300 IRP_MJ_CLOSE F:\ SUCCESS
18:08:04.9284426 svchost.exe 888 IRP_MJ_CREATE F:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\SYSTEM, OpenResult: Opened
18:08:04.9285202 svchost.exe 888 IRP_MJ_SET_INFORMATION F:\ SUCCESS Type: SetBasicInformationFile, CreationTime: 01/01/1601 00:59:59, LastAccessTime: 01/01/1601 00:59:59, LastWriteTime: 01/01/1601 00:59:59, ChangeTime: 01/01/1601 00:59:59, FileAttributes: n/a
18:08:04.9285629 svchost.exe 888 IRP_MJ_FILE_SYSTEM_CONTROL F:\ END OF FILE Control: FSCTL_FILE_PREFETCH
18:08:04.9285959 svchost.exe 888 IRP_MJ_CLEANUP F:\ SUCCESS
18:08:04.9286372 svchost.exe 888 IRP_MJ_CLOSE F:\ SUCCESS
18:08:04.9288617 svchost.exe 888 IRP_MJ_CREATE F:\\Device\HarddiskVolume3\$MFT NOT A DIRECTORY Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\SYSTEM
18:08:04.9290091 svchost.exe 888 IRP_MJ_CREATE F:\$RECYCLE.BIN\S-1-5-21-4142153632-2294863933-3660688552-1000 SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\SYSTEM, OpenResult: Opened
18:08:04.9290545 svchost.exe 888 IRP_MJ_SET_INFORMATION F:\$RECYCLE.BIN\S-1-5-21-4142153632-2294863933-3660688552-1000 SUCCESS Type: SetBasicInformationFile, CreationTime: 01/01/1601 00:59:59, LastAccessTime: 01/01/1601 00:59:59, LastWriteTime: 01/01/1601 00:59:59, ChangeTime: 01/01/1601 00:59:59, FileAttributes: n/a
18:08:04.9290826 svchost.exe 888 IRP_MJ_FILE_SYSTEM_CONTROL F:\$RECYCLE.BIN\S-1-5-21-4142153632-2294863933-3660688552-1000 END OF FILE Control: FSCTL_FILE_PREFETCH
18:08:04.9291155 svchost.exe 888 IRP_MJ_CLEANUP F:\$RECYCLE.BIN\S-1-5-21-4142153632-2294863933-3660688552-1000 SUCCESS
18:08:04.9291451 svchost.exe 888 IRP_MJ_CLOSE F:\$RECYCLE.BIN\S-1-5-21-4142153632-2294863933-3660688552-1000 SUCCESS
18:08:04.9291817 svchost.exe 888 IRP_MJ_CLOSE F:\$RECYCLE.BIN\S-1-5-21-4142153632-2294863933-3660688552-1000 SUCCESS
and then it does wake, so I’m not sure if cmdagent or svchost is actually waking it, or if cmdagent is triggering svchost in some way.
So I’m not sure what cmdagent is even doing but is there any way to prevent it accessing drive F:?