Mini Filter Driver File Creation issue in Win server 2016 and 2019

NTFSD
1

Hi,

We have developed a file system mini filter driver to have control over file/folder operations i.e read, write, delete.

While testing, found that there is a problem with one scenario in windows server 2016 and 2019. I will explain with an example.

Suppose for the folder C:\Data\Test and its sub directories, read and write are allowed but not delete.

When user tries to create a new file under Test folder, 4 files are getting created.

But if delete permission is also given, then only one file is created.

So, OS is creating 4 files and deleting 3 files.

Has anyone faced this issue? Is there a way to overcome?

Thanks.

2

What can I say? Applications are weird. I haven’t seen this particular oddity before but it doesn’t surprise me. You’ll need to debug the application procmon is your friend.

As a note for the future - you do need to be more precise. ‘When a file is created’ could mean many things - including sending a single IRP via filetest. I cannot read your mind but I’m guessing you are talking about explorer but that’s a SWAG.