Was this page helpful?
Your feedback about this content is important. Let us know what you think.
Additional feedback?
1500 characters remaining
Export (0) Print
Expand All
Expand Minimize

FltEnumerateInstances routine

The FltEnumerateInstances routine enumerates minifilter driver instances for a given minifilter driver or volume.


NTSTATUS FltEnumerateInstances(
  _In_opt_ PFLT_VOLUME   Volume,
  _In_opt_ PFLT_FILTER   Filter,
  _Out_    PFLT_INSTANCE *InstanceList,
  _In_     ULONG         InstanceListSize,
  _Out_    PULONG        NumberInstancesReturned


Volume [in, optional]

Opaque pointer for the volume for which the caller wants to enumerate minifilter driver instances. If NULL, instances for all volumes are enumerated. Must be non-NULL if Filter is NULL.

Filter [in, optional]

Opaque filter pointer for the minifilter driver whose instances are to be enumerated. If NULL, instances for all minifilter drivers are enumerated. Must be non-NULL if Volume is NULL.

InstanceList [out]

Pointer to a caller-allocated buffer that receives an array of opaque instance pointers.

InstanceListSize [in]

Number of opaque instance pointers that the buffer that InstanceList points to can hold.

NumberInstancesReturned [out]

Pointer to a caller-allocated variable that receives the number of opaque instance pointers returned in the array that InstanceList points to. If InstanceListSize is too small, FltEnumerateInstances returns STATUS_BUFFER_TOO_SMALL and sets NumberInstancesReturned to point to the number of matching instances found.

Return value

FltEnumerateInstances returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following:

Return codeDescription

The buffer that the InstanceList parameter points to is not large enough to store the requested information. This is an error code.


Volume and Filter cannot both be NULL. This is an error code.



Because the minifilter driver instances in the instance list can change at any time, two calls to FltEnumerateInstances with the same Volume and Filter values are not guaranteed to return the same result.

FltEnumerateInstances adds a rundown reference to each of the opaque instance pointers returned in the array that the InstanceList parameter points to. When these pointers are no longer needed, the caller must release them by calling FltObjectDereference on each one. Thus every successful call to FltEnumerateInstances must be matched by a subsequent call to FltObjectDereference for each returned instance pointer.

To enumerate all registered minifilter drivers, call FltEnumerateFilters.

To enumerate all volumes that are known to the Filter Manager, call FltEnumerateVolumes.

To list filter information for all registered minifilter drivers, call FltEnumerateFilterInformation.

To get filter information for a given minifilter driver, call FltGetFilterInformation.

To enumerate all instances of a given minifilter driver, call FltEnumerateInstanceInformationByFilter.

To enumerate all minifilter driver instances on a given volume, call FltEnumerateInstanceInformationByVolume.


Target platform



Fltkernel.h (include Fltkernel.h)





See also




Send comments about this topic to Microsoft

© 2015 Microsoft