| Previous | Next |
| STATUS_FLT_DO_NOT_ATTACH | STATUS_FLT_INSTANCE_ALTITUDE_COLLISION |
STATUS_FLT_DO_NOT_DETACH
STATUS_FLT_DO_NOT_DETACH is the documented response of an instance query-teardown callback when a manual detach is unsafe or premature. It prevents that manual detach from proceeding while the instance still has a reason to remain attached.
The boundary is important: this callback is not used for automatic or mandatory detach paths such as a volume dismount or filter unload. A driver must still make teardown robust for those paths; returning this status is not a permanent veto over system lifecycle events.
What to review
- Why manual detach was requested and which outstanding activity makes it unsafe.
- Whether the filter can drain its own work, close communication ports, and later permit detach.
- Whether the code incorrectly assumes that this status blocks mandatory unload.
InstanceQueryTeardownCallback | Loading and unloading minifilters | NTSTATUS reference
Looking for a different code? Search another status or error code.