Consider the following scenario:
For example, the file system filter driver denies the execution of an .exe file. When you try to run the file later, the file does not start as expected. If you check the Explorer.exe process in the Process Explorer utility, you find that the .exe file leaks a handle in the Explorer.exe process.
- You have a file system filter driver installed on a computer that is running Windows 7 or Windows Server 2008 R2. The filter driver monitors the execution of .exe files and denies any suspect execution of an .exe file.
- The execution of an .exe file is denied, and an "Access Denied" status is returned to the file in the PreAcquireForSectionSynchronization callback.
- A process calls the CreateProcess function to run the .exe file.
For example, the file system filter driver denies the execution of an .exe file. When you try to run the file later, the file does not start as expected. If you check the Explorer.exe process in the Process Explorer utility, you find that the .exe file leaks a handle in the Explorer.exe process.