Getting Warning in Event Viewer (File System Filter 'xyz' does not support bypass IO.)

NTFSD
1

Hi Everyone,

I maintain an older file system filter driver on Windows 11 where I'm encountering the following warning in the System log of Event Viewer:

File System Filter xyz does not support Bypass IO.

This log entry surfaces because the driver lacks support for Bypass IO, which is a modern I/O path optimization introduced with Windows 11. Since this is a legacy component and intentionally not being updated with Bypass IO support, I’m exploring options to either suppress the warning in Event Viewer or implement support in the driver.

My Goals

  1. Suppress the warning – Preferably via configuration, policy, or registry, so it does not clutter logging for legacy drivers that we choose not to modernize.
  2. Fallback: Enable Bypass IO – If suppressing is not viable, guidance on minimal implementation to eliminate the warning is welcome.

Questions

  1. Registry or Policy-Based Suppression
    Is there a supported Microsoft-recommended approach to suppressing this warning, perhaps via registry keys, local Group Policy, or WMI/ETW provider configuration, specifically for my filter driver?

  2. Minimal Bypass IO Support Implementation
    If suppression is not feasible, what is the minimal required implementation to prevent this warning? According to Microsoft documentation:

    • Opt into BypassIO using SUPPORTED_FS_FEATURES_BYPASS_IO in the driver’s INF or manifest.
    • Handle FSCTL_MANAGE_BYPASS_IO in the minifilter by forwarding or vetoing with FltVetoBypassIo as needed. Documentation: Supporting BypassIO operations for minifilters

    Are there concise examples or minimal implementation patterns? Even a stub that simply forwards all FS_BPIO_OP_ENABLE requests would likely suffice to suppress the warning?

2

You just need to set SUPPORTED_FS_FEATURES_BYPASS_IO and then pass any Bypass IO related FSCTLs through (like anything else you don't handle).

Now, if your filter is incompatible with Bypass IO for certain files (e.g. we don't support it on encrypted files) then you can selectively reject Bypass IO by calling FltVetoBypassIo. You don't need to bother with this though if Bypass IO doesn't matter for your filter.