Jump to content

External Hard Drives constantly spinning up and down every few minutes

Recommended Posts

Thank you, phone charges if I and others reboot it twice before plugging it in to a charger. Yes... I’m hearing Android calling me as a potential new customer.

As I went to remove the drives on my Dell just now, I saw MsMpEng.exe (Windows Defender) was locking up one of the drives while it was not being used.

I’m adding exceptions to defender for all 5 drives now to see if that has an effect. 

Link to post
Share on other sites
  • Replies 64
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

Roger. It certainly caused me some pain and frustration. Thanks again Exile you’re an absolute champion.

You're very welcome, I'm glad to be of service

Hehe, Microsoft's methods of taking control over things out of the users' hands can certainly be frustrating, but I'm glad you figured it out.  It's a double-edged sword I guess, since such automation

Posted Images

OK, once you reinstall your drives, please see if disabling Windows Defender has any impact on the issue since it was hanging up the drive from being removed.  I don't think it would be calling Powershell/WMIPrvse, but you never know; I'm not intimately familiar with the inner workings of Microsoft's AV, so it is possible.  It might just be some new implementation of Microsoft's telemetry/data harvesting causing it as well, and if that were the case I doubt there's much we could do about it.  It could also be one of their background maintenance tasks at work causing it.

Link to post
Share on other sites

Yes, try restarting after disabling Defender, though as mentioned in my response to your PM, disabling Defender in the app only really disables its real-time protection; it continues to perform its background/idle scans which is likely the source of the usage you're seeing in Process Monitor.

Link to post
Share on other sites
  • 3 weeks later...

Hi Exile,

Ok to be particular... in the context of proper methodical testing I’m probably being irresponsibly premature in posting this early (it’s only been 2hours and 10mins) but I wouldn’t post if I wasn’t convinced.

I think we’ve finally won and the culprit, seemingly... Windows Defender.

Although it’s sole purpose is to defend, understandably given the month long time frame of this troubleshooting process, I now hold a newly found contempt for it Windows Defender.

Since we last spoke I did the following:

- Reimaged the machine using a backup saved only a month prior to the problem starting. I held off installing the plethora of updates (both Windows and Malwarebytes) while I tested the drives to try and weed out the problem. Amazingly, the problem persisted which to me is completely non sensical.

- I then installed all updates for Windows, M.B and a few other applications and tested it. The problem persisted.

A work colleague who was very helpful in giving me advice on the whole subject explained to me I’d never be able to ultimately prevent power shell from running even though I turned off Powershell 2 in Windows. (If you remember powershell ‘appeared’ to be the primary offending process).

He suggested I start looking at my hardware and so I then became committed to buying a new powered hub even though mine ‘appeared’ to be working fine. I figured it was definitely worth a try.

At the last minute before doing this, I couldn’t help reflect on the two other seemingly offending processes which were Wmiprvse.exe and MsMspEng.exe. I focused on MsMspEng (Windows Defender) and commenced reading even more forums about its unwanted appearance at irregular times which seemed to conflict with user’s PC settings.

This ultimately led me (and I can’t remember where) to posts explaining how to disable Win Defender in Windows 10.

This then further led me question why my Win Defender wasn’t disabled by default given I have M.B installed and in turn to question why I should even have to go down this road of trying to disable it manually with a few tweaks (likely registry).

I soon established I needed to force Windows 10 to recognize  the installation of M.B because apparently Win 10 is known to occasionally not recognize the presence of a few anti malware and AV providers and unnecessarily run Defender in parallel.

I added a new registry DWord and associated value to force Windows 10 to do this before rebooting and testing if Defender stopped. It did not.

This then led me to the embarrassing realization there may have been a Malwarebytes GUI setting I stupidly toggled upon install two years ago which as a biproduct forced defender to run at the same time as M.B. Sure enough there was. I toggled this and rebooted. 

After reboot, finally Defender stopped and I was additionally able to see the ‘stop Win Defender from running periodic scans feature’ within Windows security settings. This was already toggled off when I arrived at it. I then promptly removed the unnecessary new DWord I’d placed in the registry confident that the Windows lack of MB awareness was due to my user error in the MB setup two years back (which from memory I think I toggled because I thought it provide more robust security in having two separate products working in tandem).

I rebooted again after removing the registry tweak and Windows security finally said for the first time it recognizes that Malwarebytes is installed and running. Because of this, Defender finally took a backseat and stayed off.

While the drives were idle (not spinning) I ran sysinternals process monitor filtering for all 5 drive letters. The drives continued to spin (this pissed me off). My gut told me process monitor was causing this (even though this sounds like lunacy).

I shutdown process monitor and the drives stopped spinning.

While making sure the room was completely silent (so I could hear any spinning start) I sat doing jobs on my phone and discussing the details for something unrelated for a period of what has now amounted to 2hrs and 15mins.

During this time, the hard drives did not spin up once and still haven’t at the time of writing this. This is the longest period of success so far!

If you recall.. they (all 5 drives) would have spun up and down repeatedly probably a minimum of 8-9 times during this time period when the problem was occurring over the last month. 

I finally feel comfortable leaving the drives plugged in (the way they have been for several years) and will continue to monitor and provide absolute confirmation in coming days.

If you have any thoughts please don’t hesitate to share them with me.

Link to post
Share on other sites

Yep, not surprised at all; we both suspected that it was Defender's background/idle scans behind it, and it looks like that was indeed the case.

A long journey to an answer, but I'm glad you finally isolated the cause (hopefully, and it definitely sounds like it, at least so far).

Anyway, please keep me posted if the issue returns, but it sounds like you finally got it and I'm glad that you did.

If there's anything else we might help you with please let us know.


Link to post
Share on other sites

Thanks Exile,

What is dumbfounding is what triggered all this given MB and Win Defender ran in parallel for several years prior and this problem never presented itself before last month. At the end of this journey I am not one to dwell on the trigger though given the problem is now seemingly solved and it was never optimal for me to be running both in parallel in the first place.

I appreciate your unrelenting drive to assist in finding the problem. The level of help you proceed is rare these days and I thank you for the time you took to attack the problem.

Link to post
Share on other sites

I suspect that my earlier assessment was correct that it was triggered by a Windows Update.  Prior to that, either Defender was configured not to scan, or it just wasn't doing so for some reason, but following the update it returned to its normal/default behavior of regularly performing scans in the background (plus Microsoft themselves may have tuned it to be more aggressive through a recent Windows Update in order to aid in their mass data collection efforts; I wouldn't put it past them to do something like that given how much of their latest OS and the updates they release regularly are dedicated to data collection/telemetry now that Microsoft is basically trying to become Google).

Link to post
Share on other sites

Hehe, Microsoft's methods of taking control over things out of the users' hands can certainly be frustrating, but I'm glad you figured it out.  It's a double-edged sword I guess, since such automation is great for most general users who don't take the time to maintain and secure their devices, but for those of us who do, and who like to have control over what happens on our devices and how their resources are used it can be quite irritating.

  • Like 1
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.