管理员可以绕过 MiniFilters ACCESS_DENIED 吗？

Question

I'm planning to develop a windows driver using a minifilter to prevent certain file manipulations (such as file access).

I checked this article that provides a good starting point on using this technology.

On the screenshots at the end of that article, any deletion of a protected file asks for administrator privileges. My question is: can a minifilter also prevent file manipulation from an administrator of the system? If this is not the case, is there any way to prevent an administrator the file manipulation?

Many thanks!

Answer 1

A minifilter can still return STATUS_ACCESS_DENIED for an operation performed by an Administrator running with elevated privileges. This will prevent the operation from succeeding. But it's nigh impossible to completely prevent an Administrator from doing something, because they can unload your driver, or override any access controls you create to prevent them from doing so. I would consider it a waste of time to try preventing an Administrator from doing anything.