Writing a FilterUnloadCallback Routine for a Minifilter Driver

A file system minifilter driver can optionally register a PFLT_FILTER_UNLOAD_CALLBACK-typed routine as the minifilter driver's FilterUnloadCallback routine. This callback routine is also referred to as the minifilter driver's unload routine.

Minifilter drivers are not required to register a FilterUnloadCallback routine. However, we strongly recommend that a minifilter driver registers this callback routine, because if a minifilter driver does not register a FilterUnloadCallback routine, the driver cannot be unloaded.

To register this callback routine, the minifilter driver stores the address of a PFLT_FILTER_UNLOAD_CALLBACK-typed routine in the FilterUnloadCallback member of the FLT_REGISTRATION structure that the minifilter driver passes as a parameter to FltRegisterFilter in its DriverEntry routine.

This section includes:

When the FilterUnloadCallback Routine Is Called

Writing a FilterUnloadCallback Routine