Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

How to filter the NFS Request using WFP

Nikhil_V_SNikhil_V_S Member - All Emails Posts: 58

I need to filter the access Network file system from client machine.
Mainly i need block the file creation and deletion operation
Is there way to do this .


  • rstruempfrstruempf Member Posts: 103

    That's a pretty broad request, but you can create a File System Minifilter Driver (, and on the Instance Setup callback (for attaching to a new volume), only attach if it is a network volume. Then any create or delete can be denied.

    Deletes can happen on IRP_MJ_CREATE, with the create option of FILE_DELETE_ON_CLOSE, or an IRP_MJ_SET_INFORMATION with FileInformationClass of either FileDispositionInformation or FileDispositionInformationEx, with the delete flag on. Neither of those guarantees that a delete will occur, but they are requests.

    Creates are more difficult. It will always be IRP_MJ_CREATE, with create disposition of FILE_OPEN_IF or FILE_OVERWRITE_IF, I think. But those are requests to create a file if it doesn't exist, but does not yet know whether it does exist. Someone with more experience will need to tell you how to test that. I imagine you need to open the file yourself to see if it exists, or just change the caller's create disposition to FILE_OPEN/FILE_OVERWRITE and let it fail naturally if the file doesn't already exist.

  • Nikhil_V_SNikhil_V_S Member - All Emails Posts: 58

    @rstruempf thank you
    Actually I tried with a minifilter .
    but i don't know how to find whether the IRP request is from NFS or not
    following block of code is used for blocking creation of "text.txt" file from all the storage device volume .but i need to block the only in NFS .
    how it is possible ?

    DbgPrint(" operation %ws blocked \n",Name);

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,448

    You can't tell in PreCreate if the file is destined for NFS or not. In post create you can query which network provider ended up handling the open (FsRtlMupGetProviderInfoFromFileObject).


Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Developing Minifilters 24 May 2021 Live, Online
Writing WDF Drivers 14 June 2021 Live, Online
Internals & Software Drivers 27 September 2021 Live, Online
Kernel Debugging TBD 2021 Live, Online