Hi,
I am in process of writing a filter driver which does the following.
I wish to protect my registry entries from user intervention(from
installation or otherwise). That is, a user can do any change in the
registry but when the system is restarted the changes done in the registry
are restored back to original.
Now I am trying to use the backup approach for it.
But not getting any way how to do it in a file system drive; what IRP’s I
will have to catch, or its just the same as saving winnt\system32\config*.*
by using IRP’s (I am not sure this approach be error prone as we I am trying
to redirect system files and using copies instead of original).
Please help.
Lalit.