Install NDIS filer driver unbinded

Question

I have built the "NDIS 6.0 Filter Driver" WinDDK sample (ndislwf.sys), and built the BindView sample to install "NDIS 6.0 Filter Driver". It installs OK, but it always bound to all Network Interfaces by default. Is it possible to install NDIS Filter Driver and have it unbound from all Network Interfaces so then I could bind it only to certain interfaces ?

The code from BindView uses SetupCopyOEMInfW to copy the driver to the OemInfs :

if ( !SetupCopyOEMInfW(lpszInfFullPath,
                               DirWithDrive,  // Other files are in the
                                              // same dir. as primary INF
                               SPOST_PATH,    // First param is path to INF
                               0,             // Default copy style
                               NULL,          // Name of the INF after
                                              // it's copied to %windir%\inf
                               0,             // Max buf. size for the above
                               NULL,          // Required size if non-null
                               NULL) ) {      // Optionally get the filename
                                              // part of Inf name after it is copied.
            dwError = GetLastError();

And then, uses INetCfgClassSetup::Install():

INetCfgClassSetup   *pncClassSetup = NULL;
INetCfgComponent    *pncc = NULL;
OBO_TOKEN           OboToken;
HRESULT             hr = S_OK;

//
// OBO_TOKEN specifies on whose behalf this
// component is being installed.
// Set it to OBO_USER so that szComponentId will be installed
// on behalf of the user.
//

ZeroMemory( &OboToken,
            sizeof(OboToken) );
OboToken.Type = OBO_USER;

//
// Get component's setup class reference.
//

hr = pnc->QueryNetCfgClass ( pguidClass,
                             IID_INetCfgClassSetup,
                             (void**)&pncClassSetup );
if ( hr == S_OK ) {

    hr = pncClassSetup->Install( szComponentId,
                                 &OboToken,
                                 0,
                                 0,       // Upgrade from build number.
                                 NULL,    // Answerfile name
                                 NULL,    // Answerfile section name
                                 &pncc ); // Reference after the component
    if ( S_OK == hr ) {                   // is installed.

        //
        // we don't need to use pncc (INetCfgComponent), release it
        //

        ReleaseRef( pncc );
    }

    ReleaseRef( pncClassSetup );
}

Answer 1

Recent versions of Windows 10 have a feature for this. Put this line into your INF:

HKR, Ndi\Interfaces, DisableDefaultBindings, 0x00010001, 1

Add that line in the same section that has the FilterMediaTypes directive.

That directive will create all new bindings to your filter in the disabled state. You can manually re-enable them in the same ways as before:

• from the command-line (Set-NetAdapterBinding);
• the GUI (run ncpa.cpl, open the adapter properties, check the box next to the filter driver); or
• from INetCfg code (INetCfgBindingPath::Enable).