Hello, Many Zw* functions that work with files (such as ZwCreateFile) need to be called at PASSIVE_LEVEL with APCs enabled: http://msdn.microsoft.com/en-us/library/ff566424%28VS.85%29.aspx. This is because, internally, I/O operations are asynchronously and the completion of an operation is delivered through an APC (correct me if I'm wrong). However, the documentation for similar functions from a mini-filter (such as FltCreateFile, FltReadFile, etc) does not specify that APCs should be enabled. Is it safe to call FltCreateFile/FltReadFile with APCs disabled? Thanks!