How to prevent changing driver letter for the mounted volumes

NTFSD
1

Hi All,

I am currently working on the file system filter driver and I would like to
implement the functionality to prevent changing the new drive letter for my
mounted volumes. I added code to look/filter around
IRP_MJ_FILE_SYSTEM_CONTROL what happens when we try to change the drive
letter via device manager, I am able to see the following sequence of calls
(FsControlCode) under IRP_MN_USER_FS_REQUEST (Minor function)

  • FSCTL_LOCK_VOLUME

  • FSCTL_DISMOUNT_VOLUME

  • FSCTL_UNLOCK_VOLUME

but I am able to see any volume setting information (even I have registered
IRP_MJ_SET_VOLUME_INFORMATION) during this events.

So I would like to know how to prevent this new drive letter assignment for
my mounted volume. Please let me know how to do it to proceed further on
this.

Thanks in advance.

Regards,
Elango C
website:http://celango.blogspot.com

2

>I am currently working on the file system filter driver and I would like to implement the functionality to

prevent changing the new drive letter for my mounted volumes.

What is the need in this, to begin with?

To implement this, you must also filter \Device\MountPointManager since MountMgr is who maintains the drive letter assignments.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com