CallbackFilter.AddFilterDefaultRule method


Pascal    C++ (Lib)    C++ (VCL)    C++ (.NET)    C#    VB.NET   

CallbackFilter     See also    


This method adds an on-boot rule.


    function AddFilterDefaultRule(Mask : TCBString; AccessFlag : LongWord; ProductName : AnsiString ): boolean;
    type TCBString = {$ifdef UNICODE}UnicodeString{$else}WideString{$endif};

[C++ (Lib)]
    bool AddFilterDefaultRule(LPCWSTR Mask, CbFltAccessFlags AccessFlag, LPSTR ProductName);

[C++ (VCL)]
    bool __fastcall AddFilterDefaultRule(WideString Mask, unsigned AccessFlag, AnsiString ProductName);

[C++ (.NET)]
    bool AddFilterDefaultRule(String^ Mask, CbFltAccessFlags AccessFlag, String^ ProductName);

    bool AddFilterDefaultRule(String Mask, CbFltAccessFlags AccessFlag, String ProductName);

    Function AddFilterDefaultRule(ByVal Mask As String, ByVal AccessFlag As CbFltAccessFlags, ByVal ProductName as String) As Boolean


  • Mask - mask of the files to apply filter to
  • AccessFlag - flags to be set on files that match the Mask
  • ProductName - the name or symbolic identifier of the program that has set the rule

Return values

TRUE / true if the function succeeded or FALSE / false if the function failed.

AccessFlag values


Use this method to add an on-boot rule, which is used by the driver loaded during system startup.

When no flags are specified in AccessFlag, the file is not accessible for any operations.

ProductName is used to distinguish the rules, set by different applications or modules. The value is used as a key in registry, so keep it short but unique. String format of GUID value works fine.

This method can be used only when the process works with Administrator or System Service rights or their equivalent. This means that you can setup the rules from the system service running under the default Service account, or from the installer, or from the application being run as Administrator. The requirement is caused by the need to modify entries under HKEY_LOCAL_MACHINE\System\CCS\Services key, which has restricted accessibility.

Read more about default rules.

Read more about masks.

See also

DeleteFilterDefaultRule     DisableDefaultRules     GetFilterDefaultCount     GetFilterDefaultRule