Is there a way to, based on a global flag I set. Flag being “int allowServiceStop = 0;”. If it equals 0 then DO NOT ALLOW [sc stop service], if set to 1 then service CAN BE STOPPED via [sc stop service]. This flag is controlled via a port connection to a user application connected to the file system minifilter driver. I have tested everything, the flag works and gets set from the user app, but I have tired returning STATUS_FLT_DO_NOT_DETACH from NTSTATUS on the Unload method when flag is set to 0, but the server just crashes.
Dear new-commer, I believe you are posting to the wrong branch. This question is ntfsd related. Post it to ntfsd instead. Also googling your problem or searching this forum gives a lot of results about unloading minifilters. I am a new-commer like you. So I suggest you to read the community guidelines at top of the page first and at least work on your problem a few hours(or even a few days) before asking. I am mot one of those lovely experts! But I feel they won’t answer a question that doesn’t show effort done by the poster. You can try this topic for more information on your question https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nc-fltkernel-pflt_filter_unload_callback Also what you mean by “server”? That word feels wrong. That crash has nothing to do with the return status you mentioned and the topic of your question. For testing how the return status to prevent unload works i suggest you do not mix the communication port and global flag and use one of the untouched minifilter samples. Well if I am wtong the experts may correct me.
Au authorized request to stop a service cannot be ignored. But you can assign an ACL that does not permit stopping