Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Current »

Since the Windows 10 Insider Preview 17063 announced on the 20th December 2017 a new restriction has need added that unfortunately has caused the Macrium Reflect Changed Block Tracker (CBT) driver (MrCbt.sys) not to load at startup. 

Stop Code

INACCESSIBLE BOOT DEVICE


So what's happened?

MrCbt.sys is a Windows kernel driver that follows a similar architecture to Microsoft's own Volume Shadow copy Service (VSS) driver VolSnap.sys. The style of this driver is known as 'Legacy' and there are several MS drivers of this type in the kernel stack, in all versions of Windows. 

Windows 10 version 1607, introduced a new registry entry to block legacy drivers - IoBlockLegacyFsFilters, and this registry entry had to be explicitly set to exclude legacy drivers from loading.  However, the default value for this new registry entry has been changed from '0' (Not blocked) to '1' (blocked) in the Insider Preview 17063 build of Windows 10.  This means that that no 'Legacy' kernel drivers, except for Microsoft's own legacy drivers, are loaded at boot time. Unfortunately this causes a fatal error when Windows starts if any legacy driver is designated as a boot start upper filter driver. 

More information on IoBlockLegacyFsFilters can be found here: https://docs.microsoft.com/en-gb/windows-hardware/drivers/ifs/blocking-file-system-filter-drivers

What can be done?

Assuming that this default registry change makes it to production versions of Windows then the solution is to re-write our CBT driver to prevent it being classified as legacy.  In the short term creating IoBlockLegacyFsFilters with a value of '0' will allow MrCbt.sys to load and operate without problems. 

Key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\I/O System
Name:IoBlockLegacyFsFilters
Type:REG_DWORD
Value:0



  • No labels