Generates a record in the update sequence number (USN) change journal stream for the input file. This record will have the USN_REASON_CLOSE flag.

To perform this operation, call the DeviceIoControl function with the following parameters.

DeviceIoControl( (HANDLE) hDevice,              // handle to volume
                 FSCTL_WRITE_USN_CLOSE_RECORD,  // dwIoControlCode
                 NULL,                          // lpInBuffer
                 0,                             // nInBufferSize
                 (LPVOID) lpOutBuffer,          // output buffer
                 (DWORD) nOutBufferSize,        // size of output buffer
                 (LPDWORD) lpBytesReturned,     // number of bytes returned
                 (LPOVERLAPPED) lpOverlapped ); // OVERLAPPED structure



A handle to the file or directory for which the close record is to be generated. To retrieve a handle, call the CreateFile function.


The control code for the operation. Use FSCTL_WRITE_USN_CLOSE_RECORD for this operation.


Not used with this operation; set to NULL.


Not used with this operation; set to zero.


A pointer to the output buffer that receives the USN for the close record.


The size of the output buffer, in bytes. Must be large enough to store a USN.


A pointer to a variable that receives the size of the data stored in the output buffer, in bytes.

If the output buffer is too small, the call fails, GetLastError returns ERROR_INSUFFICIENT_BUFFER, and lpBytesReturned is zero.

If lpOverlapped is NULL, lpBytesReturned cannot be NULL. Even when an operation returns no output data and lpOutBuffer is NULL, DeviceIoControl makes use of lpBytesReturned. After such an operation, the value of lpBytesReturned is meaningless.

If lpOverlapped is not NULL, lpBytesReturned can be NULL. If this parameter is not NULL and the operation returns data, lpBytesReturned is meaningless until the overlapped operation has completed. To retrieve the number of bytes returned, call GetOverlappedResult. If hDevice is associated with an I/O completion port, you can retrieve the number of bytes returned by calling GetQueuedCompletionStatus.


A pointer to an OVERLAPPED structure.

If hDevice was opened without specifying FILE_FLAG_OVERLAPPED, lpOverlapped is ignored.

If hDevice was opened with the FILE_FLAG_OVERLAPPED flag, the operation is performed as an overlapped (asynchronous) operation. In this case, lpOverlapped must point to a valid OVERLAPPED structure that contains a handle to an event object. Otherwise, the function fails in unpredictable ways.

For overlapped operations, DeviceIoControl returns immediately, and the event object is signaled when the operation has been completed. Otherwise, the function does not return until the operation has been completed or an error occurs.

Return value

If the operation completes successfully, DeviceIoControl returns a nonzero value.

If the operation fails or is pending, DeviceIoControl returns zero. To get extended error information, call GetLastError.

Possible return values include the following.

Return codeDescription

The specified volume does not support change journals. Where supported, change journals can also be deleted.


One or more parameters was invalid. For example, DeviceIoControl returns this error code if the handle supplied is not a volume handle.


An attempt was made to read from, create, delete, or modify the journal while a journal deletion was under way, or an attempt was made to write a USN record while a journal deletion was under way.



For the implications of overlapped I/O on this operation, see the Remarks section for DeviceIoControl.

You can use FSCTL_WRITE_USN_CLOSE_RECORD to force a close record into the change journal for the input handle. The close record will contain any current USN reasons for this file as well. The output buffer will return the USN value associated with this operation.

For more information, see Creating, Modifying, and Deleting a Change Journal.

To retrieve a handle to a volume, call CreateFile with the lpFileName parameter set to a string in the following form:


In the preceding string, X is the letter identifying the drive on which the volume appears. The volume must be NTFS 3.0 or later. To obtain the NTFS version of a volume, open a command prompt with Administrator access rights and execute the following command:

fsutil fsinfo ntfsinfo X:

where X is the drive letter of the volume.

In Windows 8 and Windows Server 2012, this code is supported by the following technologies.


Server Message Block (SMB) 3.0 protocol


SMB 3.0 Transparent Failover (TFO)


SMB 3.0 with Scale-out File Shares (SO)


Cluster Shared Volume File System (CsvFS)



Transacted Operations

If FSCTL_WRITE_USN_CLOSE_RECORD is called with a handle that is locked by a transaction, it always fails.


Minimum supported client

Windows XP [desktop apps only]

Minimum supported server

Windows Server 2003 [desktop apps only]


WinIoCtl.h (include Windows.h)

See also

Change Journals
Volume Management Control Codes