All drivers that participate in the Windows Hardware Compatibility Program (WHCP) are expected to meet Microsoft’s baseline quality, reliability, and security requirements before they are signed and distributed. These requirements are enforced through Hardware Lab Kit (HLK) testing and certification workflows.
Historically, HLK testing coverage was most consistently applied to hardware device drivers. As a result, software drivers and filter drivers did not always receive the same level of automated test coverage, even though they operate in equally privileged and security‑sensitive areas of the operating system.
This gap has now been addressed.
What Changed
To improve validation of file system mini‑filters and other Filter Manager (fltmgr) clients, new test capabilities were added that allow HLK and Windows Driver Test Framework (WDTF)–based scenarios to reason explicitly about filter drivers.
These updates include:
Enhanced Driver Verifier
Filter Verifier is now enabled for File System MiniFilter and software drivers. Filter Verifier validates correct usage of Filter Manager APIs, enforces object-lifetime rules and integrates with Driver Verifier (DV) to surface violation during runtime testing.
See File System Filter Verification , Storport Verification and I/O Verification
What this enables
When Filter Verifier is enabled and exercised through DV/WDTF testing, additional Driver Verifier checks are applied across the active device stack. These checks may surface violations such as:
- Execution‑context violations
Reported via Driver Verifier (for example, VRF_ExecutionContext!PollWorkerEntry) when a driver executes at an invalid IRQL or in an inappropriate threading context. - Leaked pool allocations
Reported when verified drivers fail to release memory during unload or stress scenarios (for example, VRF_LEAKED_POOL_IMAGE_*). - Security‑isolation and object‑lifetime violations
Reported when kernel objects such as FLT_CALLBACK_DATA or FILE_OBJECT are not correctly released.
WDTF/DEVFUND Improvements
Expanded Test Coverage
Windows Device Testing Framework (WDTF) is used to support the verification of Filesystem MiniFilters drivers. As part of this work, HLK coverage for software and filter drivers was significantly expanded, increasing the number of applicable HLK tests from 22 to 41. This expansion enables a broader set of existing DevFund scenarios to run against filesystem filter drivers, substantially improving validation coverage for correctness, reliability, and OS contract compliance.
WDTF Action Plugins
New WDTF action plugins were introduced and integrated into FIlter Manager (Fltmgr) API based tests into DevFund in the HLK to enable more targeted validation of File System MiniFilter drivers. These tests leverage Filter Manager User-Mode Library.
The WDTF volume plugin has been updated with this new functionality. The new coverage will apply to the following filters
- FSFilter Activity Monitor
- FSFilter Anti‑Virus
- FSFilter Bottom
- FSFilter Cluster File System
- FSFilter Compression
- FSFilter Content Screener
- FSFilter Continuous Backup
- FSFilter Copy Protection
- FSFilter Encryption
- FSFilter HSM
- FSFilter Imaging
- FSFilter Open File
- FSFilter Physical Quota Management
- FSFilter Quota Management
- FSFilter Replication
- FSFilter Security Enhancer
- FSFilter System Recovery
- FSFilter Top
- FSFilter Undelete
- FSFilter Virtualization
These plugins allow tests to observe I/O behavior, apply Driver Verifier dynamically, and generate concurrent I/O patterns under stress conditions.
WDTF Datagathers updates
WDTF datagathers were enhanced to enumerate active File System MiniFilter drivers on a per‑volume basis using Filter Manager APIs. This allows tests to accurately detect loaded filters, their attachment state, and associated filter communication ports, enabling DevFund and HLK tests to correctly target and validate filesystem filter drivers
WDTF IO Plugin Updates
Several WDTF I/O plugins were updated to improve Filesystem MiniFilter validation:
- The Volume WDTF plugin was updated to leverage Filter Manager (FltMgr) APIs when exercising File System MiniFilter functionality.
- Support was added for validating filter communication ports.
- FSCTL‑based I/O was introduced to better exercise filesystem‑specific control paths.
- The WDTF Driver Verifier plugin was enhanced to enable targeted verification during DevFund and HLK test execution, including:
- WDM I/O verification,
- Filter Verifier for filesystem filters,
- SCSI and Storport verifiers for disk and storage drivers.
This work ensures that filter drivers—especially those operating in security‑sensitive paths—are exercised and validated using the same framework rigor as other kernel‑mode drivers.
Previously, some tests did not enumerate for these driver classes due to tooling limitations. Those limitations have been removed, and HLK now applies the appropriate tests to these drivers where applicable.
Why This Matters
Software and filter drivers play a critical role in system stability and security. Ensuring they are validated consistently helps improve ecosystem reliability and reduces the risk of system‑wide impact from driver failures.
No new certification bar has been introduced. Instead, this change closes a gap where HLK behavior did not fully reflect the security and quality intent that already applied to kernel‑mode drivers.
The goal is consistency:
- Software drivers
- Filter drivers
- Hardware device drivers
are all held to the same baseline expectations when they participate in WHCP.
Call to Action
If you develop:
- Kernel‑mode software drivers
- File system mini‑filters
- Security‑sensitive filter drivers
you may now see additional HLK tests enumerate where they previously did not. This reflects corrected tooling behavior, not a policy change.
If you encounter unexpected results or believe a test is being applied incorrectly, please engage through the standard driver support channels.
Microsoft