minifilter unload and detach by users

NTFSD
1

Is it good or bad practice to allow user minifilter manual unload? The system will not crash but driver wan’t do its work and user can complain on that.

Another thing that if i disallow to unload minifilter by setting up to FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP flag i should also to disallow instance detach but then i see no way to determine whether the user is trying to detach
instance manually with “fltmc detach”, for instance, or I am try to detach manually from kernel code with FltDetachVolume(I use this approach to detach in runtime). Because in both cases I will see FLTFL_INSTANCE_TEARDOWN_MANUAL in instance tear down callback. So second question is there way to find out doest the user is forced detach or I not?

2

>Is it good or bad practice to allow user minifilter manual unload?

Depends on the type of your filter. For an Activity Monitor it’s good - for an Encryption Filter it’s probably not a good idea to support unloading.

Your Unload Callback may check conditions: unload if the FLTFL_FILTER_UNLOAD_MANDATORY ist set - otherwise stay