Ever since the release of Filter Manager over 10 years ago, there have been rumblings about the fate of the existing legacy File System Filters (i.e. any FS filter that didn’t use Filter Manager)*. It was clear that they were going to be deprecated at some point, but when and how?
The first nail in the coffin for these filters came when they were flagged as no longer eligible for HCK certification. Of course, how much this really matters for a product varies greatly and so it doesn’t wholesale cut off legacy filter development. Though the rumor is that Server v.Next will block any drivers that are not HCK certified, which certainly makes this a major looming issue for folks in the server space.
However, we do have a more immediate and unexpected death to the legacy FS filter model: the IoBlockLegacyFsFilters registry value. Starting in Build 1607, administrators will be able to set this value to prevent the system from loading ANY legacy FS filters.
So, if you’ve been sitting around for a decade waiting for a good reason to port your legacy FS filter, NOW is the time to act! Clearly things aren’t going to get any better for legacy FS filters and it’s time to get the process started.
Here at OSR we’ve written dozens of legacy FS filters, dozens of Filter Manager filters, and also have been involved in lots of different ports between the two. Unfortunately the difficulty level for porting is hard to predict, it very much depends on the complexity of the solution and the implementation (e.g. an activity monitor may be very easy to port, an encryption filter maybe not so much). If this is going to affect your product and you’re not quite sure where to go, contact us and we can help you get going in the right direction.
*HINT: If you’re not sure if you’re a legacy FS filter, grep your source code for IoRegisterFsRegistrationChange