Block RegNtSetValueKey on XP

NTDEV
1

Hello everyone, here’s a simple one:

Since RegNtSetValueKey doesn’t have a pre operation on XP, can I cancel it?
I’m from the File system filter world where you cancel operations in the pre-operation.

Thanks a bunch,

Gene

2

D’oh! Nevermind. I found it. You know…RTFM.

RegNtSetValueKey
Specifies that a thread is attempting to set a value entry for a key. This value indicates a PRE-NOTIFICATION call to RegistryCallback. Use this value only on Windows XP.