> Just remember it does not undo anything that has happened to the file. It
does not delete newly created files. If files are created with the
FILE_DELETE_ON_CLOSE flag, it will be too late to cancel the deletion.
Another example: A new file has been created with GENERIC_READ - you can’t
delete the file on the network server without reopening the
file with delete access.
IMHO cancelling anything in post create is never going to work completely.
Yes, it looks pretty easy and tempting to do it in post-create
(“Hey I am gonna let FS do the dirty stuff and if something happens,
then I will just deny it.”).
But the truth is, it might be very difficult to undo all operations
that Create operation did.
L.
> This is about 15-th question about cancelling file open in the last
month or so
Yeah, but on the bright side, there hasn’t been an encryption/notepad
question in a week or two 
~Eric
>> This is about 15-th question about cancelling file open in the last
> month or so
Yeah, but on the bright side, there hasn’t been an encryption/notepad
question in a week or two
Don’t worry - as soon as the posters solve cancelling of
IRP_MJ_CREATE, they come across to that (sorry for being so evil :P).
L.
Have you seen the scanner sample ? It seems to do just that. Also it seems
to call FltCancelFileOpen without checking first if any handles have been
created for the file.
/Daniel
“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
IMHO cancelling anything in post create is never going to work completely.
Yes, it looks pretty easy and tempting to do it in post-create
(“Hey I am gonna let FS do the dirty stuff and if something happens,
then I will just deny it.”).
But the truth is, it might be very difficult to undo all operations
that Create operation did.
L.