| Previous | Next |
| ERROR_FLT_DO_NOT_ATTACH | ERROR_FLT_INSTANCE_ALTITUDE_COLLISION |
ERROR_FLT_DO_NOT_DETACH
A manual detach was vetoed by the instance
ERROR_FLT_DO_NOT_DETACH is an intentional response from a minifilter's InstanceQueryTeardownCallback. It prevents a manual request from detaching the instance from its volume. The callback exists so a filter can reject detachment while its own policy says removal would be unsafe.
This status applies to manual detach paths such as a user-mode FilterDetach call or a kernel-mode FltDetachVolume call. It does not veto automatic or mandatory teardown caused by driver unload or volume dismount. Treating it as a general protection against every teardown is a design error.
What to check
- Identify who issued the manual detach request and which filter instance, volume, and optional instance name were selected.
- Record the concrete veto condition, such as active protected work or an application policy requirement. A permanent unexplained veto makes maintenance and incident response difficult.
- Verify that teardown-related state can be drained or transferred before retrying. Do not keep arbitrary locks or wait for user-mode replies inside lifecycle callbacks.
- Differentiate this code from
ERROR_FLT_INSTANCE_NOT_FOUND: a veto means a matching instance existed and chose not to detach; not-found means no matching attached instance was located.
References
- Microsoft: PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK
- Microsoft: FltDetachVolume
- OSR: minifilter lifecycle and dynamic unloading
Looking for a different code? Search another status or error code.