I’ve a question about legacy filter driver – “Group” in the Registry set to “Filter”. Using fltmc.exe utiltity I can see that the driver is above other filter drivers like Quota. What my concern is that I believe fltmc.exe lists the altitude by reading the registry and not actual location in the stack. I think so because if I change the Group value in the registry and NOT REBOOT, fltmc.exe list modifed altitutde for the legacy driver.
So my quation is can I change altitude by just changing Group value and rebooting the server? Or this is like a driver install thing and can’t be changed any more.
I also have driver listed in “UpperFilters” under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{71A27CDD-812A-11D0-BEC7-08002BE2092F}.
I’m going to assume that this is a file system filter. You can change the
group in the registry after install, but it won’t be used until the next
system boot.
The right group for the filter depends on what the filter does. You can see
a list of groups here http://msdn.microsoft.com/en-us/library/ff549689(VS.85).aspx (or search for
“Load Order Groups and Altitudes for Minifilter Drivers”). You should select
the appropriate group for your filter and set it and filter manager will try
its best to accommodate this by creating frames with the right altitudes…
Being a legacy filter, it will always go to the top of the stack, but by
setting the group properly you can ensure that other minifilters and legacy
filters that belong above yours have not yet been loaded.
Fltmc internally calls FilterFindFirst/Next, which eventually makes into
filter manager in something like FltEnumerateFilterInformation and that
looks at the group in the registry to decide the altitude.