Thanks — that DriverFrameworks User‑Mode critical event (Event ID 10116) is an important clue: it shows the Surface Base 2 firmware update process crashed while running in user mode, which can leave the firmware/driver partially applied and the Hello/IR driver unbound. In plain terms: Windows can see the AVStream camera and the IR camera software device, but the Hello “liveness” driver/firmware binding is not finishing because the Surface firmware update/driver process crashed. That’s why Settings says “We couldn’t find a compatible camera.” ordered, safe checklist you can run (low → higher risk). Do them exactly in order, paste the indicated outputs back here, and I’ll interpret them and give the precise follow‑ups (including the exact pnputil or pnputil /add‑driver line if the INF exists). Important: back up your data first (image or at least copy critical files), run firmware installs on AC power, and don’t interrupt a firmware flash.
Quick summary of what to do next
- Check & temporarily disable Memory Integrity (Core isolation). This can block drivers from loading.
- Confirm DriverSttil) and search for Hello/IR INFs. If DriverStore can’t enumerate, restore INF ACLs (secedit) then re-run pnputil.
- Reinstall the official Surface Book 2 & Firmware package (run the MSI as Administrator). Reboot and re-check. Re‑running often completes a flash that failed silently.
- Collect the relevant System logs (Kernel‑PnP and DriverFrad the pnputil output so we can pinpoint the failure code and take the precise action (bind INF, repair ACLs, or escalate to service).
Step‑by‑step (copy/paste the exact commands)
A — Very quick checks and backup
1) (Macrium, AOMEI, or copy critical files). Don’t skip this if you’ll reinstall firmware.
2) Check Memory Integrity (Core isolation)
- Settings → Privacy & security → Device security → Core isolation details
- If “Memory integrity” is ON, toggle it OFF, then reboot. (This is temporary for troubleshooting; you can re‑enable if driver installs succeed.) Memory integrity can prevent older kernel drivers from loading and is a common blocker for Hello drivers.
B — Collect PnP / driver store info (critical diagnostics)
Open an elevated Command Prompt (Run as Admiese:
1) Dump driver store list into a file (this shows whether the Hello/IR INF exists)
pnputil /enum-drivers > C:\Users\Public\pnputil.txt && notepad C:\Users\Public\pnputil.txt
- After Notepad opens, search inside for strings: camera, ir, intel, avstream, hello, windowshello, helloFace, Surface. Paste any oem*.inf lines you find that look related.
2) Check driver‑store folder ACLs / count entries (in the same elevated CMD)
icacls "C:\Windows\System32\DriverStore\FileRepository"
dir /b "C:\Windows\System32\DriverStore\FileRepository" | find /v "" /c
- If icacls shows ACCESS DENIED or odd ACLs, tell me the output — we’ll run the safe secedit ACL restore next. Issues here explain why Windows can’t bind drivers.
3) Search installed INF files for Hello/Face strings (optional; useful)
findstr /S /M /I "hello windowshello helloface face"
findstr /S /M /I "hello windowshello helloface face" "%windir%\System32\DriverStore\FileRepository*.inf"
- Paste any full filenames returned (or “none”).
4) List currently installed camera drivers (shows InfName/provider/version)
Open an elevated PowerShell and run:
Get-CimInstance Win32
PnPSignedDriver | Where-Object { $.DeviceName -match 'IR Camera|AVStream Camera|IntelIR|Windows Hello|Hello|Face' } | Select-Object DeviceName,Manufacturer,DriverVersion,InfName | Format-Table -AutoSize
5) Enumerate Hello/camera PnP devices (confirm InstanceIds)
In elevated PowerShell:
Get-PnpDevice -PresentOnly | Where-Object { $_.FriendlyName -match 'Camera|IR|Intel|Hello|Face' } | Format-Table Status,Class,FriendlyName,InstanceId -AutoSize
C — Collect System event logs that matter (Kernel‑PnP & DriverFrameworks)
Run these (admin PowerShell) — they’ll save the last 48 hours of PnP and DriverFrameworks events into files you can open:
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-PnP'; StartTime=(Get-Date).AddDays(-2)} | Select-Object TimeCreated,Id,LevelDisplayName,Message | Out-File C:\Users\Public\PnpEvents.txt -Width 4096
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-DriverFrameworks-UserMode'; StartTime=(Get-Date).AddDays(-2)} | Select-Object TimeCreated,Id,LevelDisplayName,Message | Out-File C:\Users\Public\DFEvents.txt -Width 4096
- Open both files (C:\Users\Public\PnpEvents.txt and C:\Users\Public\DFEvents.txt) in Notepad and paste any ERROR/CRITICAL lines that reference Hello, HelloFace, IR, firmware, Surface, or oem*.inf. The DFEvents.txt will include the 10116 messages you pasted; those help tell us whether the firmware flash crashed or a user-mode driver crashed repeatedly. The message you supplied (Surface Base 2 Firmware Update offline due to user-mode driver crash) is exactly the sort of entry I expect to see in DFEvents.txt. That event often indicates the firmware/driver process failed and needs to be re‑run or escalated.
D — Repair driver store ACLs (only if pnputil failed/ACCESS DENIED)
If pnputil failed to enumerate drivers or icacls showed odd ACLs, run (Admin gure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose
(reboot)
then re-run pnputil /enum-drivers and paste the resulting C:\Users\Public\pnputil.txt output again.
- This restore of default INF ACLs is a standard, safe repair that often fixes driver‑store enumeration issues so Windows can bind drivers.
E — Reinstall Surface Book 2 Drivers & Firmware package (Model 1832)
- Download the official Surface Book 2 (Model 1832) Drivers & Firmware package from Microsoft’s Ssearch “Surface Book 2 drivers and firmware Model 1832” on Microsoft’s site). Unzip and run the included Surface_Drivers_xxx.msi as Administrator. Reboot when the installer asks. Do this on AC power and after a backup. Re‑running this package often finishes a firmware/driver bind that failed earlier and will add the HelloFace INF into the driver store if it’s missing.
After the installer finishes and you reboot:
- Re-run pnputil /enum-drivers and Get-PnpDevice commands from above and paste the outputs here.
- If the installer reports a firmware flash f Diagnostic Toolkit reports a failed step, copy that error text — it tells us whether this is a software/driver problem or a firmware/hardware problem.
F — If the Hello driver INF exists in the store but isn’t bound
If you find an oemXX.inf in pnputil that looks like the Hello/IR INF (I’ll help identify it), we will run:
pnputil /add-driver "C:\full\path\to\oemXX.inf" /install
That forces Windows to install and bind that driver to matching devices.
G — If firmware update repeatedly crashes (DF event 10116 still appears)
- Run the Surface Diagnostic for Business tool (Surface Diagnostic Toolkit) and save/export the logs. If the toolkit shows a failed firmware step for the Surface Base 2 firmware update, this often requires Microsoft/Surface service to reflash the module or provide a corrected firmware — that’s when we escalate to repair/service. If we go that route I’ll tell you exactly which logs/screenshots and the brief description to include in a Microsoft support case (having your serial already listed helps).
What I need from you to proceed right now
1) Tell me whether Memory integrity was ON or OFF and, if ON, toggle it OFF and reboot. Then re‑check Settings → Sign‑in options.
2) Run the pnputil command and opputil.txt; paste any oem*.inf lines that reference camera, ir, hello, Surface, Intel, AVStream, or similar.
3) Paste the contents (ERROR/CRITICAL lines) from C:\Users\Publreference Surface Base 2 Firmware Update (Event ID 10116) or other firmware/driver crashes; also paste any Kernel‑PnP errors from C:\Users\Public\PnpEvents.txt.
4 will re‑run the Surface Book 2 driver+firmware MSI now (and confirm you have AC power and a backup).
If we find the INF in the driver store I’ll give the exact pnputil add‑driver command and, if necessary, a short manual “Have Disk” procedure toevice Manager. If DriverStore enumeration is broken we’ll run the secedit ACL repair and then reinstall the Surface package. Ifails repeatedly and logs show user‑mode driver crashes, we’ll prepare a Surface service escalation (logs + serial) because that step points at a firmware/board reflash or module replacement.
Short, plain next message you can paste back here
- “Memory integrity was ON/OFF. I ran pnputil and pasted the following oem*.inf lines: … . DFEvents.txt shows these ERROR lines: … . I will (or will not) re‑run the Surface MSI now.”
I’ll parse your outputs and give the exact low‑risk commands to fix the Helloto escalate to Microsoft service, including the precise logs and steps they’ll want. You’re on the right path — the hardware is visible, we just need to finish the driver/firmware binding or repair the driver store that’s preventing it.
). I searched everywhere for the compatible driver for the IR camera so i can activate the HELLO FACE without success . NB: the regular cam is working and filming normally. ANY HELP IS WELCOME . 
