ZwDeleteKey and STATUS_CANNOT_DELETE

NTDEV
1

I have a driver that is monitoring registry operations and performing
some work on a shadow of the registry. In certain rare circumstances I
get a STATUS_CANNOT_DELETE while deleting a key in the shadow registry.
Can someone give me a hint what conditions cause this error message from
a ZwDeleteKey call?

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

2

On 17-Oct-2011 19:35, Don Burn wrote:

I have a driver that is monitoring registry operations and performing
some work on a shadow of the registry. In certain rare circumstances I
get a STATUS_CANNOT_DELETE while deleting a key in the shadow registry.
Can someone give me a hint what conditions cause this error message from
a ZwDeleteKey call?

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

IIRC, when the key or subkeys have live opens.

– pa