Filter manager driver

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. Feedback will be sent to Microsoft: By pressing the submit button, your feedback will be used to improve Microsoft products and services. Privacy policy. When AttachWhenLoaded is set to zero, the filter manager does not attach to any volumes until a minifilter driver registers with the filter manager.

To disable filter drivers, you must first identify third-party services and their corresponding filter drivers.

After you do this, follow these steps. This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk. An antivirus program is designed to help protect your computer from viruses. You must not download or open files from sources that you do not trust, visit Web sites that you do not trust, or open e-mail attachments when your antivirus program is disabled.

For more information about computer viruses, see How to prevent and remove viruses and other malware. Set the Start registry key of the corresponding filter drivers to 0x4. A value of 0x4 will disable the filter driver. To do this, follow these steps. This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly.

Ability to unload while system is running. Unlike a legacy filter driver, which cannot be unloaded while the system is running, a minifilter driver can be unloaded at any time, and it can prevent itself from being unloaded if necessary. The filter manager synchronizes safe removal of all minifilter driver attachments, and it handles operations that complete after the minifilter driver is unloaded. Ability to process only necessary operations. More efficient use of kernel stack.

The filter manager is optimized to reduce the amount of kernel stack it uses, and the callback model greatly reduces the impact of minifilter drivers on the stack. Less redundant code. The filter manager reduces the amount of code required for a minifilter driver in a number of ways, such as providing infrastructure for name generation and caching file names for use by more than one minifilter driver. The filter manager attaches to volumes and notifies minifilter drivers when a volume is available.

Typically, such filters redefine hardware behavior to match expected specifications. For example, a lower-level class filter driver for mouse devices could provide acceleration, performing a nonlinear conversion of mouse movement data.

Upper-level filter drivers typically provide added-value features for a device see the Possible Driver Layers figure. Such drivers are usually provided by IHVs and are optional.

There can be any number of upper-level filter drivers for a device. An upper-level device filter driver adds value for a particular device. For example, an upper-level device filter driver for a keyboard could enforce additional security checks.