locked
Runtime vs Management Filter Layers RRS feed

  • Question

  •  

    What exactly are the differences between a Management Filter Layer and a Runtime Filter Layer, as described in the following MSDN Article:  http://msdn2.microsoft.com/en-us/library/aa504935.aspx ? I am familiar with the Management Filter Layers, as I have been using them in (User Mode) applications. I assume Runtime Filters apply to Kernel Mode, but I am not sure what the difference is between Runtime and Management and why this difference is there.

     

    What are typical situations where each of these types of Filter Layers are being used?

     

    Thanks,

     

    Inq.

     

    Thursday, August 30, 2007 2:07 PM

Answers

  • Management layer IDs are defined to be GUID (128 bits), Runtime layer IDs are smaller LUID (64 bits) so are better for kernel mode use. They point to the same layers. You can just use Runtime IDs in kernel mode and Management IDs in user mode. When calling a management API ('Fwpm...()') in kernel mode, you may need to use GUID.

     

    Charlie

    Thursday, August 30, 2007 8:50 PM