Hello,
I would like to set a disk volume to read only (XP or higher).
Preferred would be to this from a minifilter (fs filter driver - I know, I’m here in the ntdev group 
).
I was able to to this via diskpart (found it on the web):
in diskpart do a “select volume X” (where X is the correct volume number)
then in diskpart doa “att vol set readonly”
then in diskpart do a “detail vol” and ensure the readonly bit is set
then you can mount the volume, the volume will be readonly
Additional:
Even if I could write a device driver reacting on the IOCTL_DISK_IS_WRITABLE with false,
It would not help, as it could be that the driver was not started again (maybe safe mode, etc.)
So I have some questions about this:
a)
I saw with filemon that vds.exe does some IOCTL to the drive.
But the IOCTL is 0x560004 - and I found no description about this IOCTL.
Any idea?
b) What is it the way to set the volume to readonly - maybe without vds.exe?
so doing similar things like diskpart and vds.exe do.
c) If vds.exe is required, can the filter (device driver) use vds api functions?
Many Thanks
Norbert