Export (0) Print
Expand All

Load Order Groups and Altitudes for Minifilter Drivers

Windows uses a dedicated set of load order groups for file system filter drivers and minifilter drivers that are loaded at system startup.

Legacy file system filter drivers can attach only to the top of an existing file system driver stack and cannot attach in the middle of a stack. As a result, the start type for a driver and load order group are important to legacy file system filter drivers, because the earlier a filter driver loads, the lower it can attach on the file system driver stack.

Drivers are loaded first based on the start type for the driver, which represents phases of booting a system. For more information about start types, see "Driver Start Types" in What Determines When a Driver Is Loaded. All file system filter drivers and minifilter drivers that specify a start type of SERVICE_BOOT_START will be loaded before drivers with a start type of SERVICE_SYSTEM_START or SERVICE_AUTO_START. The start type is specified by the StartType entry in the ServiceInstall Section of an INF file that is used to install the minifilter driver. Within each start type category, the load order group determines when file system filter drivers and minifilter drivers will be loaded.

A minifilter driver can be loaded at any time. The concept of load order groups is still required by minifilter drivers for interoperability with legacy file system filter drivers. Every minifilter driver must have a unique identifier called altitude. The altitude of a minifilter driver defines its position relative to other minifilter drivers in the I/O stack when the minifilter driver is loaded. The altitude is an infinite-precision string interpreted as a decimal number. A minifilter driver that has a low numerical altitude is loaded into the I/O stack below a minifilter driver that has a higher numerical value.

Each load order group has a defined range of altitudes. The allocation of altitudes to minifilter drivers is managed by Microsoft. To request an altitude for your minifilter driver, send an email message to fsfcomm@microsoft.com asking for one to be assigned.

A minifilter driver must specify an altitude value from an altitude range that represents a load order group. Altitude values for a minifilter driver are specified in the Instance definitions of the Strings Section in the INF file that is used to install the minifilter driver. Instance definitions can also be specified in calls to the InstanceSetupCallback routine in the FLT_REGISTRATION structure. Multiple instances and altitudes can be defined for a minifilter driver. These instance definitions apply across all volumes.

The following rules about start type and load order groups determine when a minifilter driver will be loaded:

  • A minifilter driver that specifies a particular start type and load order group is loaded at the same time as other file system filter drivers and minifilter drivers in that start type and load order group.

  • Within each load order group, file system filter drivers and minifilter drivers are generally loaded in random order. This normally results in drivers being loaded based on the order in which the driver was installed.

  • If a file system filter driver or minifilter driver does not specify a load order group, it is loaded after all the other drivers of the same start type that do specify a load order group.

The following table lists the system-defined load order groups and altitude ranges for minifilter drivers. For each load order group, the Load order group column contains the value that should be specified for that group in the LoadOrderGroup entry in the ServiceInstall Section of a minifilter's INF file. The Altitude range column contains the range of altitudes for a particular load order group. A minifilter driver must request an altitude allocation from Microsoft in the appropriate load order group or groups.

Note that the load order groups and altitude ranges are listed as they appear on the stack, which is the reverse of the order in which they are loaded.

Load order groupAltitude rangeDescription

Filter

420000-429999

This group is the same as the Filter load order group that was available on Windows 2000 and earlier. This group loads last and thus attaches furthest from the file system.

FSFilter Top

400000-409999

This group is provided for filter drivers that must attach above all other FSFilter types.

FSFilter Activity Monitor

360000-389999

This group includes filter drivers that observe and report on file I/O.

FSFilter Undelete

340000-349999

This group includes filters that recover deleted files.

FSFilter Anti-Virus

320000-329999

This group includes filter drivers that detect and disinfect viruses during file I/O.

FSFilter Replication

300000-309999

This group includes filter drivers that replicate file data to remote servers.

FSFilter Continuous Backup

280000-289999

This group includes filter drivers that replicate file data to backup media.

FSFilter Content Screener

260000-269999

This group includes filter drivers that prevent the creation of specific files or file content.

FSFilter Quota Management

240000-249999

This group includes filter drivers that provide enhanced file system quotas.

FSFilter System Recovery

220000-229999

This group includes filter drivers that perform operations to maintain operating system integrity, such as the System Restore (SR) filter.

FSFilter Cluster File System

200000-209999

This group includes filter drivers that are used in products that provide file server metadata across a network.

FSFilter HSM

180000-189999

This group includes filter drivers that perform hierarchical storage management.

FSFilter Imaging

170000-175000

This group includes ZIP-like filter drivers that provide a virtual namespace.

This load group is available on Windows Vista and later versions of the operating system.

FSFilter Compression

160000-169999

This group includes filter drivers that perform file data compression.

FSFilter Encryption

140000-149999

This group includes filter drivers that encrypt and decrypt data during file I/O.

FSFilter Virtualization

130000- 139999

This group includes filter drivers that virtualize the file path, such as the Least Authorized User (LUA) filter driver added in Windows Vista.

This load group is available on Windows Vista and later versions of the operating system.

FSFilter Physical Quota Management

120000-129999

This group includes filter drivers that manage quotas by using physical block counts.

FSFilter Open File

100000-109999

This group includes filter drivers that provide snapshots of already open files.

FSFilter Security Enhancer

80000-89999

This group includes filter drivers that apply lockdown and enhanced access control lists (ACLs).

FSFilter Copy Protection

60000-69999

This group includes filter drivers that check for out-of-band data on media.

FSFilter Bottom

40000-49999

This group is provided for filter drivers that must attach below all other FSFilter types.

FSFilter System

20000-29999

Reserved for internal use.

FSFilter Infrastructure

Reserved for internal use. This group loads first and thus attaches closest to the file system.

 

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft