Switch to final registry key loading paradigm

22 files changed, 1143 insertions, 310 deletions

diff --git a/filesys/miniFilter/MetadataManager/MetadataManagerInit.c b/filesys/miniFilter/MetadataManager/MetadataManagerInit.c
index 3b371360..dbedd3a8 100644
--- a/filesys/miniFilter/MetadataManager/MetadataManagerInit.c
+++ b/filesys/miniFilter/MetadataManager/MetadataManagerInit.c
@@ -86,6 +86,28 @@ FmmInstanceTeardownComplete (
 
 #if DBG
 
+typedef
+NTSTATUS
+(*PFN_IoOpenDriverRegistryKey) (
+    PDRIVER_OBJECT     DriverObject,
+    DRIVER_REGKEY_TYPE RegKeyType,
+    ACCESS_MASK        DesiredAccess,
+    ULONG              Flags,
+    PHANDLE            DriverRegKey
+    );
+
+PFN_IoOpenDriverRegistryKey
+FmmGetIoOpenDriverRegistryKey (
+    VOID
+    );
+
+NTSTATUS
+FmmOpenServiceParametersKey (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
+    );
+
 VOID
 FmmInitializeDebugLevel (
     _In_ PDRIVER_OBJECT DriverObject,
@@ -102,6 +124,8 @@ FmmInitializeDebugLevel (
 #pragma alloc_text(INIT, DriverEntry)
 
 #if DBG
+#pragma alloc_text(INIT, FmmGetIoOpenDriverRegistryKey)
+#pragma alloc_text(INIT, FmmOpenServiceParametersKey)
 #pragma alloc_text(INIT, FmmInitializeDebugLevel)
 #endif
 
@@ -300,18 +324,36 @@ Return Value:
 
 #if DBG
 
-VOID
-FmmInitializeDebugLevel (
+PFN_IoOpenDriverRegistryKey
+FmmGetIoOpenDriverRegistryKey (
+    VOID
+    )
+{
+    static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL;
+    UNICODE_STRING FunctionName = {0};
+
+    if (pIoOpenDriverRegistryKey == NULL) {
+
+        RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey");
+
+        pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName);
+    }
+
+    return pIoOpenDriverRegistryKey;
+}
+
+NTSTATUS
+FmmOpenServiceParametersKey (
     _In_ PDRIVER_OBJECT DriverObject,
-    _In_ PUNICODE_STRING RegistryPath
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
     )
 /*++
 
 Routine Description:
 
-    This routine tries to read the filter DebugLevel parameter from
-    the registry.  This value will be found in the registry location
-    indicated by the RegistryPath passed in.
+    This routine opens the service parameters key, using the isolation-compliant
+    APIs when possible.
 
 Arguments:
 
@@ -320,66 +362,82 @@ Arguments:
 
     RegistryPath - The path key passed to the driver during DriverEntry.
 
+    ServiceParametersKey - Returns a handle to the service parameters subkey.
+
 Return Value:
 
-    None.
+    STATUS_SUCCESS if the function completes successfully.  Otherwise a valid
+    NTSTATUS code is returned.
 
 --*/
 {
-    OBJECT_ATTRIBUTES attributes;
-    OSVERSIONINFOW versionInfo;
-    HANDLE driverRegKey = NULL;
     NTSTATUS status;
-    ULONG resultLength;
-    UNICODE_STRING valueName;
-    UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )];
-
-    Globals.DebugLevel = DEBUG_TRACE_ERROR;
-
-    RtlZeroMemory( &versionInfo, sizeof( versionInfo ) );
+    PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey;
+    UNICODE_STRING Subkey;
+    HANDLE ParametersKey = NULL;
+    HANDLE ServiceRegKey = NULL;
+    OBJECT_ATTRIBUTES Attributes;
 
     //
-    // Determine the OS version being run.
+    //  Open the parameters key to read values from the INF, using the API to
+    //  open the key if possible
     //
 
-    versionInfo.dwOSVersionInfoSize = sizeof( versionInfo );
+    pIoOpenDriverRegistryKey = FmmGetIoOpenDriverRegistryKey();
 
-    status = RtlGetVersion( &versionInfo );
+    if (pIoOpenDriverRegistryKey != NULL) {
 
-    if (!NT_SUCCESS( status )) {
+        //
+        //  Open the parameters key using the API
+        //
 
-        goto cleanup;
-    }
+        status = pIoOpenDriverRegistryKey( DriverObject,
+                                           DriverRegKeyParameters,
+                                           KEY_READ,
+                                           0,
+                                           &ParametersKey );
 
-    //
-    //  Open the desired registry key
-    //
+        if (!NT_SUCCESS( status )) {
+
+            goto cleanup;
+        }
+
+    } else {
 
-    if (versionInfo.dwBuildNumber >= 25952) {
         //
-        // Open the Parameters key for the service.
+        //  Open specified service root key
         //
 
-        status = IoOpenDriverRegistryKey( DriverObject,
-                                          DriverRegKeyParameters,
-                                          KEY_READ,
-                                          0,
-                                          &driverRegKey );
+        InitializeObjectAttributes( &Attributes,
+                                    ServiceRegistryPath,
+                                    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
+                                    NULL,
+                                    NULL );
+
+        status = ZwOpenKey( &ServiceRegKey,
+                            KEY_READ,
+                            &Attributes );
 
         if (!NT_SUCCESS( status )) {
 
             goto cleanup;
         }
-    } else {
-        InitializeObjectAttributes( &attributes,
-                                    RegistryPath,
+
+        //
+        //  Open the parameters key relative to service key path
+        //
+
+        RtlInitUnicodeString( &Subkey, L"Parameters" );
+
+        InitializeObjectAttributes( &Attributes,
+                                    &Subkey,
                                     OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
-                                    NULL,
+                                    ServiceRegKey,
                                     NULL );
 
-        status = ZwOpenKey( &driverRegKey,
+        status = ZwOpenKey( &ParametersKey,
                             KEY_READ,
-                            &attributes );
+                            &Attributes );
 
         if (!NT_SUCCESS( status )) {
 
@@ -388,6 +446,71 @@ Return Value:
     }
 
     //
+    //  Return value to caller
+    //
+
+    *ServiceParametersKey = ParametersKey;
+
+cleanup:
+
+    if (ServiceRegKey != NULL) {
+
+        ZwClose( ServiceRegKey );
+    }
+
+    return status;
+
+}
+
+VOID
+FmmInitializeDebugLevel (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+    )
+/*++
+
+Routine Description:
+
+    This routine tries to read the filter DebugLevel parameter from
+    the registry.  This value will be found in the registry location
+    indicated by the RegistryPath passed in.
+
+Arguments:
+
+    DriverObject - Pointer to driver object created by the system to
+        represent this driver.
+
+    RegistryPath - The path key passed to the driver during DriverEntry.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    HANDLE driverRegKey = NULL;
+    NTSTATUS status;
+    ULONG resultLength;
+    UNICODE_STRING valueName;
+    UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )];
+
+    Globals.DebugLevel = DEBUG_TRACE_ERROR;
+
+    //
+    //  Open service parameters key to query values from.
+    //
+
+    status = FmmOpenServiceParametersKey( DriverObject,
+                                          RegistryPath,
+                                          &driverRegKey );
+
+    if (!NT_SUCCESS( status )) {
+
+        driverRegKey = NULL;
+        goto cleanup;
+    }
+
+    //
     // Read the DebugFlags value from the registry.
     //
 
diff --git a/filesys/miniFilter/MetadataManager/fmm.inf b/filesys/miniFilter/MetadataManager/fmm.inf
index 02285a21..ad231a8c 100644
--- a/filesys/miniFilter/MetadataManager/fmm.inf
+++ b/filesys/miniFilter/MetadataManager/fmm.inf
diff --git a/filesys/miniFilter/NameChanger/NameChanger.inf b/filesys/miniFilter/NameChanger/NameChanger.inf
index 1969dbd5..7c0b2364 100644
--- a/filesys/miniFilter/NameChanger/NameChanger.inf
+++ b/filesys/miniFilter/NameChanger/NameChanger.inf
diff --git a/filesys/miniFilter/NameChanger/ncinit.c b/filesys/miniFilter/NameChanger/ncinit.c
index 3dbc24bf..7d125498 100644
--- a/filesys/miniFilter/NameChanger/ncinit.c
+++ b/filesys/miniFilter/NameChanger/ncinit.c
@@ -15,7 +15,31 @@ NcIs8DOT3Compatible (
     _In_opt_ PUNICODE_STRING LongName
     );
 
+typedef
+NTSTATUS
+(*PFN_IoOpenDriverRegistryKey) (
+    PDRIVER_OBJECT     DriverObject,
+    DRIVER_REGKEY_TYPE RegKeyType,
+    ACCESS_MASK        DesiredAccess,
+    ULONG              Flags,
+    PHANDLE            DriverRegKey
+    );
+
+PFN_IoOpenDriverRegistryKey
+NcGetIoOpenDriverRegistryKey (
+    VOID
+    );
+
+NTSTATUS
+NcOpenServiceParametersKey (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
+    );
+
 #ifdef ALLOC_PRAGMA
+#pragma alloc_text(INIT, NcGetIoOpenDriverRegistryKey)
+#pragma alloc_text(INIT, NcOpenServiceParametersKey)
 #pragma alloc_text(INIT, NcInitializeMapping)
 #pragma alloc_text(INIT, NcLoadRegistryString)
 #pragma alloc_text(INIT, NcIs8DOT3Compatible)
@@ -278,18 +302,36 @@ NcIs8DOT3Compatible (
 
 }
 
+PFN_IoOpenDriverRegistryKey
+NcGetIoOpenDriverRegistryKey (
+    VOID
+    )
+{
+    static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL;
+    UNICODE_STRING FunctionName = {0};
+
+    if (pIoOpenDriverRegistryKey == NULL) {
+
+        RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey");
+
+        pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName);
+    }
+
+    return pIoOpenDriverRegistryKey;
+}
+
 NTSTATUS
-NcInitializeMapping(
+NcOpenServiceParametersKey (
     _In_ PDRIVER_OBJECT DriverObject,
-    _In_ PUNICODE_STRING RegistryPath
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
     )
 /*++
 
-Routine Descrition:
+Routine Description:
 
-    This routine initializes the mapping structure. It will
-    try to populate it from the registry, and if that fails
-    use a default string.
+    This routine opens the service parameters key, using the isolation-compliant
+    APIs when possible.
 
 Arguments:
 
@@ -298,79 +340,155 @@ Arguments:
 
     RegistryPath - The path key passed to the driver during DriverEntry.
 
+    ServiceParametersKey - Returns a handle to the service parameters subkey.
+
 Return Value:
 
-    None.
+    STATUS_SUCCESS if the function completes successfully.  Otherwise a valid
+    NTSTATUS code is returned.
 
 --*/
 {
-    NTSTATUS Status;
-    OSVERSIONINFOW versionInfo;
+    NTSTATUS status;
+    PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey;
+    UNICODE_STRING Subkey;
+    HANDLE ParametersKey = NULL;
+    HANDLE ServiceRegKey = NULL;
     OBJECT_ATTRIBUTES Attributes;
-    HANDLE DriverRegKey = NULL;
-    UNICODE_STRING TempPath = EMPTY_UNICODE_STRING;
-    USHORT Index;
-
-    PAGED_CODE();
-
-    RtlZeroMemory( &NcGlobalData, sizeof( NcGlobalData ));
-
-    RtlZeroMemory( &versionInfo, sizeof( versionInfo ) );
 
     //
-    // Determine the OS version being run.
+    //  Open the parameters key to read values from the INF, using the API to
+    //  open the key if possible
     //
 
-    versionInfo.dwOSVersionInfoSize = sizeof( versionInfo );
+    pIoOpenDriverRegistryKey = NcGetIoOpenDriverRegistryKey();
 
-    Status = RtlGetVersion( &versionInfo );
+    if (pIoOpenDriverRegistryKey != NULL) {
 
-    if (!NT_SUCCESS( Status )) {
+        //
+        //  Open the parameters key using the API
+        //
 
-        goto NcInitializeMappingCleanup;
-    }
+        status = pIoOpenDriverRegistryKey( DriverObject,
+                                           DriverRegKeyParameters,
+                                           KEY_READ,
+                                           0,
+                                           &ParametersKey );
 
-    //
-    //  Open the desired registry key
-    //
+        if (!NT_SUCCESS( status )) {
+
+            goto cleanup;
+        }
+
+    } else {
 
-    if (versionInfo.dwBuildNumber >= 25952) {
         //
-        // Open the Parameters key for the service.
+        //  Open specified service root key
         //
 
-        Status = IoOpenDriverRegistryKey( DriverObject,
-                                          DriverRegKeyParameters,
-                                          KEY_READ,
-                                          0,
-                                          &DriverRegKey );
+        InitializeObjectAttributes( &Attributes,
+                                    ServiceRegistryPath,
+                                    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
+                                    NULL,
+                                    NULL );
+
+        status = ZwOpenKey( &ServiceRegKey,
+                            KEY_READ,
+                            &Attributes );
 
-        if (!NT_SUCCESS( Status )) {
+        if (!NT_SUCCESS( status )) {
 
-            goto NcInitializeMappingCleanup;
+            goto cleanup;
         }
-    } else {
+
         //
-        // Open legacy registry key.
+        //  Open the parameters key relative to service key path
         //
 
+        RtlInitUnicodeString( &Subkey, L"Parameters" );
+
         InitializeObjectAttributes( &Attributes,
-                                    RegistryPath,
+                                    &Subkey,
                                     OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
-                                    NULL,
+                                    ServiceRegKey,
                                     NULL );
 
-        Status = ZwOpenKey( &DriverRegKey,
+        status = ZwOpenKey( &ParametersKey,
                             KEY_READ,
                             &Attributes );
 
-        if (!NT_SUCCESS( Status )) {
+        if (!NT_SUCCESS( status )) {
 
-            FLT_ASSERT( DriverRegKey == NULL );
-            goto NcInitializeMappingCleanup;
+            goto cleanup;
         }
     }
 
+    //
+    //  Return value to caller
+    //
+
+    *ServiceParametersKey = ParametersKey;
+
+cleanup:
+
+    if (ServiceRegKey != NULL) {
+
+        ZwClose( ServiceRegKey );
+    }
+
+    return status;
+
+}
+
+NTSTATUS
+NcInitializeMapping(
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+    )
+/*++
+
+Routine Descrition:
+
+    This routine initializes the mapping structure. It will
+    try to populate it from the registry, and if that fails
+    use a default string.
+
+Arguments:
+
+    DriverObject - Pointer to driver object created by the system to
+        represent this driver.
+
+    RegistryPath - The path key passed to the driver during DriverEntry.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    NTSTATUS Status;
+    HANDLE DriverRegKey = NULL;
+    UNICODE_STRING TempPath = EMPTY_UNICODE_STRING;
+    USHORT Index;
+
+    PAGED_CODE();
+
+    RtlZeroMemory( &NcGlobalData, sizeof( NcGlobalData ));
+
+    //
+    //  Open service parameters key to query values from.
+    //
+
+    Status = NcOpenServiceParametersKey( DriverObject,
+                                         RegistryPath,
+                                         &DriverRegKey );
+
+    if (!NT_SUCCESS( Status )) {
+
+        DriverRegKey = NULL;
+        goto NcInitializeMappingCleanup;
+    }
+
     Status = NcLoadRegistryString( DriverRegKey,
                                    L"UserMapping",
                                    &TempPath );
diff --git a/filesys/miniFilter/avscan/avscan.inf b/filesys/miniFilter/avscan/avscan.inf
index f74d9a60..27091ee3 100644
--- a/filesys/miniFilter/avscan/avscan.inf
+++ b/filesys/miniFilter/avscan/avscan.inf
diff --git a/filesys/miniFilter/avscan/filter/avscan.c b/filesys/miniFilter/avscan/filter/avscan.c
index 669bde87..3c96fd08 100644
--- a/filesys/miniFilter/avscan/filter/avscan.c
+++ b/filesys/miniFilter/avscan/filter/avscan.c
@@ -34,6 +34,29 @@ DriverEntry (
     _In_ PUNICODE_STRING RegistryPath
     );
 
+typedef
+NTSTATUS
+(*PFN_IoOpenDriverRegistryKey) (
+    PDRIVER_OBJECT     DriverObject,
+    DRIVER_REGKEY_TYPE RegKeyType,
+    ACCESS_MASK        DesiredAccess,
+    ULONG              Flags,
+    PHANDLE            DriverRegKey
+    );
+
+PFN_IoOpenDriverRegistryKey
+AvGetIoOpenDriverRegistryKey (
+    VOID
+    );
+
+NTSTATUS
+AvOpenServiceParametersKey (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
+    );
+
+
 NTSTATUS
 AvSetConfiguration (
     _In_ PDRIVER_OBJECT DriverObject,
@@ -202,6 +225,8 @@ AvSendUnloadingToUser (
 
 #ifdef ALLOC_PRAGMA
 #pragma alloc_text(INIT, DriverEntry)
+#pragma alloc_text(INIT, AvGetIoOpenDriverRegistryKey)
+#pragma alloc_text(INIT, AvOpenServiceParametersKey)
 #pragma alloc_text(INIT, AvSetConfiguration)
 #pragma alloc_text(PAGE, AvUnload)
 #pragma alloc_text(PAGE, AvInstanceQueryTeardown)
@@ -3028,16 +3053,36 @@ Return Value:
     return STATUS_SUCCESS;
 }
 
+PFN_IoOpenDriverRegistryKey
+AvGetIoOpenDriverRegistryKey (
+    VOID
+    )
+{
+    static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL;
+    UNICODE_STRING FunctionName = {0};
+
+    if (pIoOpenDriverRegistryKey == NULL) {
+
+        RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey");
+
+        pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName);
+    }
+
+    return pIoOpenDriverRegistryKey;
+}
+
 NTSTATUS
-AvSetConfiguration (
+AvOpenServiceParametersKey (
     _In_ PDRIVER_OBJECT DriverObject,
-    _In_ PUNICODE_STRING RegistryPath
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
     )
 /*++
 
-Routine Descrition:
+Routine Description:
 
-    This routine sets the filter configuration based on registry values.
+    This routine opens the service parameters key, using the isolation-compliant
+    APIs when possible.
 
 Arguments:
 
@@ -3046,80 +3091,152 @@ Arguments:
 
     RegistryPath - The path key passed to the driver during DriverEntry.
 
-Return Value:
+    ServiceParametersKey - Returns a handle to the service parameters subkey.
 
-    Returns the status of this operation.
+Return Value:
 
+    STATUS_SUCCESS if the function completes successfully.  Otherwise a valid
+    NTSTATUS code is returned.
 
 --*/
 {
-    NTSTATUS status;
-    OSVERSIONINFOW versionInfo;
-    OBJECT_ATTRIBUTES attributes;
-    HANDLE settingsKey = NULL;
-    UNICODE_STRING valueName;
-    UCHAR buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG)];
-    PKEY_VALUE_PARTIAL_INFORMATION value = (PKEY_VALUE_PARTIAL_INFORMATION)buffer;
-    ULONG valueLength = sizeof(buffer);
-    ULONG resultLength;
-
-    RtlZeroMemory( &versionInfo, sizeof( versionInfo ) );
+    NTSTATUS Status;
+    PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey;
+    UNICODE_STRING Subkey;
+    HANDLE ParametersKey = NULL;
+    HANDLE ServiceRegKey = NULL;
+    OBJECT_ATTRIBUTES Attributes;
 
     //
-    // Determine the OS version being run.
+    //  Open the parameters key to read values from the INF, using the API to
+    //  open the key if possible
     //
 
-    versionInfo.dwOSVersionInfoSize = sizeof( versionInfo );
+    pIoOpenDriverRegistryKey = AvGetIoOpenDriverRegistryKey();
 
-    status = RtlGetVersion( &versionInfo );
+    if (pIoOpenDriverRegistryKey != NULL) {
 
-    if (!NT_SUCCESS( status )) {
+        //
+        //  Open the parameters key using the API
+        //
 
-        goto Cleanup;
-    }
+        Status = pIoOpenDriverRegistryKey( DriverObject,
+                                           DriverRegKeyParameters,
+                                           KEY_READ,
+                                           0,
+                                           &ParametersKey );
 
-    //
-    // Open corresponding registry root.
-    // NOTE: Build number should match the INF file.
-    //
+        if (!NT_SUCCESS( Status )) {
+
+            goto OpenServiceParametersKeyCleanup;
+        }
+
+    } else {
 
-    if (versionInfo.dwBuildNumber >= 25952) {
         //
-        // Open the Parameters key for the service.
+        //  Open specified service root key
         //
 
-        status = IoOpenDriverRegistryKey( DriverObject,
-                                          DriverRegKeyParameters,
-                                          KEY_READ,
-                                          0,
-                                          &settingsKey );
+        InitializeObjectAttributes( &Attributes,
+                                    ServiceRegistryPath,
+                                    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
+                                    NULL,
+                                    NULL );
+
+        Status = ZwOpenKey( &ServiceRegKey,
+                            KEY_READ,
+                            &Attributes );
 
-        if (!NT_SUCCESS( status )) {
+        if (!NT_SUCCESS( Status )) {
 
-            goto Cleanup;
+            goto OpenServiceParametersKeyCleanup;
         }
 
-    } else {
         //
-        //  Open the legacy settings registry key.
+        //  Open the parameters key relative to service key path
         //
 
-        InitializeObjectAttributes( &attributes,
-                                    RegistryPath,
+        RtlInitUnicodeString( &Subkey, L"Parameters" );
+
+        InitializeObjectAttributes( &Attributes,
+                                    &Subkey,
                                     OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
-                                    NULL,
+                                    ServiceRegKey,
                                     NULL );
 
-        status = ZwOpenKey( &settingsKey,
+        Status = ZwOpenKey( &ParametersKey,
                             KEY_READ,
-                            &attributes );
+                            &Attributes );
 
-        if (!NT_SUCCESS( status )) {
+        if (!NT_SUCCESS( Status )) {
 
-            goto Cleanup;
+            goto OpenServiceParametersKeyCleanup;
         }
     }
 
+    //
+    //  Return value to caller
+    //
+
+    *ServiceParametersKey = ParametersKey;
+
+OpenServiceParametersKeyCleanup:
+
+    if (ServiceRegKey != NULL) {
+
+        ZwClose( ServiceRegKey );
+    }
+
+    return Status;
+
+}
+
+NTSTATUS
+AvSetConfiguration (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+    )
+/*++
+
+Routine Descrition:
+
+    This routine sets the filter configuration based on registry values.
+
+Arguments:
+
+    DriverObject - Pointer to driver object created by the system to
+        represent this driver.
+
+    RegistryPath - The path key passed to the driver during DriverEntry.
+
+Return Value:
+
+    Returns the status of this operation.
+
+
+--*/
+{
+    NTSTATUS status;
+    HANDLE settingsKey = NULL;
+    UNICODE_STRING valueName;
+    UCHAR buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG)];
+    PKEY_VALUE_PARTIAL_INFORMATION value = (PKEY_VALUE_PARTIAL_INFORMATION)buffer;
+    ULONG valueLength = sizeof(buffer);
+    ULONG resultLength;
+
+    //
+    //  Open service parameters key to query values from
+    //
+
+    status = AvOpenServiceParametersKey( DriverObject,
+                                         RegistryPath,
+                                         &settingsKey );
+
+    if (!NT_SUCCESS( status )) {
+
+        goto Cleanup;
+    }
+
 #if DBG
 
     //
diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.c b/filesys/miniFilter/cancelSafe/cancelSafe.c
index af0f9bef..4aeb2e26 100644
--- a/filesys/miniFilter/cancelSafe/cancelSafe.c
+++ b/filesys/miniFilter/cancelSafe/cancelSafe.c
@@ -665,11 +665,10 @@ Return Value:
 
     if (!NT_SUCCESS( Status )) {
 
+        DriverRegKey = NULL;
         goto SetConfigurationCleanup;
     }
 
-    CloseHandle = TRUE;
-
     //
     //  Query the debug level.
     //
@@ -789,7 +788,7 @@ Return Value:
 
 SetConfigurationCleanup:
 
-    if (CloseHandle) {
+    if (DriverRegKey != NULL) {
 
         ZwClose( DriverRegKey );
     }
diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.inf b/filesys/miniFilter/cancelSafe/cancelSafe.inf
index aca61673..69d0ccf1 100644
--- a/filesys/miniFilter/cancelSafe/cancelSafe.inf
+++ b/filesys/miniFilter/cancelSafe/cancelSafe.inf
diff --git a/filesys/miniFilter/cdo/CdoInit.c b/filesys/miniFilter/cdo/CdoInit.c
index a7d04e36..f913f6fb 100644
--- a/filesys/miniFilter/cdo/CdoInit.c
+++ b/filesys/miniFilter/cdo/CdoInit.c
@@ -48,6 +48,28 @@ CdoInstanceSetup (
 
 #if DBG
 
+typedef
+NTSTATUS
+(*PFN_IoOpenDriverRegistryKey) (
+    PDRIVER_OBJECT     DriverObject,
+    DRIVER_REGKEY_TYPE RegKeyType,
+    ACCESS_MASK        DesiredAccess,
+    ULONG              Flags,
+    PHANDLE            DriverRegKey
+    );
+
+PFN_IoOpenDriverRegistryKey
+CdoGetIoOpenDriverRegistryKey (
+    VOID
+    );
+
+NTSTATUS
+CdoOpenServiceParametersKey (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
+    );
+
 VOID
 CdoInitializeDebugLevel (
     _In_ PDRIVER_OBJECT DriverObject,
@@ -76,6 +98,8 @@ CDO_GLOBAL_DATA Globals;
 #pragma alloc_text(INIT, DriverEntry)
 
 #if DBG
+#pragma alloc_text(INIT, CdoGetIoOpenDriverRegistryKey)
+#pragma alloc_text(INIT, CdoOpenServiceParametersKey)
 #pragma alloc_text(INIT, CdoInitializeDebugLevel)
 #endif
 
@@ -189,18 +213,36 @@ DriverEntry(
 
 #if DBG
 
-VOID
-CdoInitializeDebugLevel (
+PFN_IoOpenDriverRegistryKey
+CdoGetIoOpenDriverRegistryKey (
+    VOID
+    )
+{
+    static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL;
+    UNICODE_STRING FunctionName = {0};
+
+    if (pIoOpenDriverRegistryKey == NULL) {
+
+        RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey");
+
+        pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName);
+    }
+
+    return pIoOpenDriverRegistryKey;
+}
+
+NTSTATUS
+CdoOpenServiceParametersKey (
     _In_ PDRIVER_OBJECT DriverObject,
-    _In_ PUNICODE_STRING RegistryPath
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
     )
 /*++
 
 Routine Description:
 
-    This routine tries to read the filter DebugLevel parameter from
-    the registry.  This value will be found in the registry location
-    indicated by the RegistryPath passed in.
+    This routine opens the service parameters key, using the isolation-compliant
+    APIs when possible.
 
 Arguments:
 
@@ -209,74 +251,155 @@ Arguments:
 
     RegistryPath - The path key passed to the driver during DriverEntry.
 
+    ServiceParametersKey - Returns a handle to the service parameters subkey.
+
 Return Value:
 
-    None.
+    STATUS_SUCCESS if the function completes successfully.  Otherwise a valid
+    NTSTATUS code is returned.
 
 --*/
 {
-    OBJECT_ATTRIBUTES attributes;
-    OSVERSIONINFOW versionInfo;
-    HANDLE driverRegKey = NULL;
-    NTSTATUS status;
-    ULONG resultLength;
-    UNICODE_STRING valueName;
-    UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )];
-
-    Globals.DebugLevel = DEBUG_TRACE_ERROR;
-
-    RtlZeroMemory( &versionInfo, sizeof( versionInfo ) );
+    NTSTATUS Status;
+    PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey;
+    UNICODE_STRING Subkey;
+    HANDLE ParametersKey = NULL;
+    HANDLE ServiceRegKey = NULL;
+    OBJECT_ATTRIBUTES Attributes;
 
     //
-    // Determine the OS version being run.
+    //  Open the parameters key to read values from the INF, using the API to
+    //  open the key if possible.
     //
 
-    versionInfo.dwOSVersionInfoSize = sizeof( versionInfo );
+    pIoOpenDriverRegistryKey = CdoGetIoOpenDriverRegistryKey();
 
-    status = RtlGetVersion( &versionInfo );
+    if (pIoOpenDriverRegistryKey != NULL) {
 
-    if (!NT_SUCCESS( status )) {
+        //
+        //  Open the parameters key using the API.
+        //
 
-        goto cleanup;
-    }
+        Status = pIoOpenDriverRegistryKey( DriverObject,
+                                           DriverRegKeyParameters,
+                                           KEY_READ,
+                                           0,
+                                           &ParametersKey );
 
-    //
-    //  Open the desired registry key
-    //
+        if (!NT_SUCCESS( Status )) {
+
+            goto cleanup;
+        }
+
+    } else {
 
-    if (versionInfo.dwBuildNumber >= 25952) {
         //
-        // Open the Parameters key for the service.
+        //  Open specified service root key.
         //
 
-        status = IoOpenDriverRegistryKey( DriverObject,
-                                          DriverRegKeyParameters,
-                                          KEY_READ,
-                                          0,
-                                          &driverRegKey );
+        InitializeObjectAttributes( &Attributes,
+                                    ServiceRegistryPath,
+                                    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
+                                    NULL,
+                                    NULL );
 
-        if (!NT_SUCCESS( status )) {
+        Status = ZwOpenKey( &ServiceRegKey,
+                            KEY_READ,
+                            &Attributes );
+
+        if (!NT_SUCCESS( Status )) {
 
             goto cleanup;
         }
-    } else {
-        InitializeObjectAttributes( &attributes,
-                                    RegistryPath,
+
+        //
+        //  Open the parameters key relative to service key path.
+        //
+
+        RtlInitUnicodeString( &Subkey, L"Parameters" );
+
+        InitializeObjectAttributes( &Attributes,
+                                    &Subkey,
                                     OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
-                                    NULL,
+                                    ServiceRegKey,
                                     NULL );
 
-        status = ZwOpenKey( &driverRegKey,
+        Status = ZwOpenKey( &ParametersKey,
                             KEY_READ,
-                            &attributes );
+                            &Attributes );
 
-        if (!NT_SUCCESS( status )) {
+        if (!NT_SUCCESS( Status )) {
 
             goto cleanup;
         }
     }
 
     //
+    //  Return value to caller.
+    //
+
+    *ServiceParametersKey = ParametersKey;
+
+cleanup:
+
+    if (ServiceRegKey != NULL) {
+
+        ZwClose( ServiceRegKey );
+    }
+
+    return Status;
+
+}
+
+VOID
+CdoInitializeDebugLevel (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+    )
+/*++
+
+Routine Description:
+
+    This routine tries to read the filter DebugLevel parameter from
+    the registry.  This value will be found in the registry location
+    indicated by the RegistryPath passed in.
+
+Arguments:
+
+    DriverObject - Pointer to driver object created by the system to
+        represent this driver.
+
+    RegistryPath - The path key passed to the driver during DriverEntry.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    HANDLE driverRegKey = NULL;
+    NTSTATUS status;
+    ULONG resultLength;
+    UNICODE_STRING valueName;
+    UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )];
+
+    Globals.DebugLevel = DEBUG_TRACE_ERROR;
+
+    //
+    //  Open service parameters key to query values from.
+    //
+
+    status = CdoOpenServiceParametersKey( DriverObject,
+                                          RegistryPath,
+                                          &driverRegKey );
+
+    if (!NT_SUCCESS( status )) {
+
+        driverRegKey = NULL;
+        goto cleanup;
+    }
+
+    //
     // Read the DebugFlags value from the registry.
     //
 
diff --git a/filesys/miniFilter/cdo/cdo.inf b/filesys/miniFilter/cdo/cdo.inf
index 0403e340..cdac24d9 100644
--- a/filesys/miniFilter/cdo/cdo.inf
+++ b/filesys/miniFilter/cdo/cdo.inf
diff --git a/filesys/miniFilter/change/change.inf b/filesys/miniFilter/change/change.inf
index a9233eed..e7da4250 100644
--- a/filesys/miniFilter/change/change.inf
+++ b/filesys/miniFilter/change/change.inf
diff --git a/filesys/miniFilter/ctx/CtxInit.c b/filesys/miniFilter/ctx/CtxInit.c
index fb04eef1..e1e2576a 100644
--- a/filesys/miniFilter/ctx/CtxInit.c
+++ b/filesys/miniFilter/ctx/CtxInit.c
@@ -78,6 +78,28 @@ CtxInstanceTeardownComplete (
 
 #if DBG
 
+typedef
+NTSTATUS
+(*PFN_IoOpenDriverRegistryKey) (
+    PDRIVER_OBJECT     DriverObject,
+    DRIVER_REGKEY_TYPE RegKeyType,
+    ACCESS_MASK        DesiredAccess,
+    ULONG              Flags,
+    PHANDLE            DriverRegKey
+    );
+
+PFN_IoOpenDriverRegistryKey
+CtxGetIoOpenDriverRegistryKey (
+    VOID
+    );
+
+NTSTATUS
+CtxOpenServiceParametersKey (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
+    );
+
 VOID
 CtxInitializeDebugLevel (
     _In_ PDRIVER_OBJECT DriverObject,
@@ -94,6 +116,8 @@ CtxInitializeDebugLevel (
 #pragma alloc_text(INIT, DriverEntry)
 
 #if DBG
+#pragma alloc_text(INIT, CtxGetIoOpenDriverRegistryKey)
+#pragma alloc_text(INIT, CtxOpenServiceParametersKey)
 #pragma alloc_text(INIT, CtxInitializeDebugLevel)
 #endif
 
@@ -275,18 +299,36 @@ Return Value:
 
 #if DBG
 
-VOID
-CtxInitializeDebugLevel (
+PFN_IoOpenDriverRegistryKey
+CtxGetIoOpenDriverRegistryKey (
+    VOID
+    )
+{
+    static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL;
+    UNICODE_STRING FunctionName = {0};
+
+    if (pIoOpenDriverRegistryKey == NULL) {
+
+        RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey");
+
+        pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName);
+    }
+
+    return pIoOpenDriverRegistryKey;
+}
+
+NTSTATUS
+CtxOpenServiceParametersKey (
     _In_ PDRIVER_OBJECT DriverObject,
-    _In_ PUNICODE_STRING RegistryPath
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
     )
 /*++
 
 Routine Description:
 
-    This routine tries to read the filter DebugLevel parameter from
-    the registry.  This value will be found in the registry location
-    indicated by the RegistryPath passed in.
+    This routine opens the service parameters key, using the isolation-compliant
+    APIs when possible.
 
 Arguments:
 
@@ -295,70 +337,82 @@ Arguments:
 
     RegistryPath - The path key passed to the driver during DriverEntry.
 
+    ServiceParametersKey - Returns a handle to the service parameters subkey.
+
 Return Value:
 
-    None.
+    STATUS_SUCCESS if the function completes successfully.  Otherwise a valid
+    NTSTATUS code is returned.
 
 --*/
 {
-    OBJECT_ATTRIBUTES attributes;
-    OSVERSIONINFOW versionInfo;
-    HANDLE driverRegKey = NULL;
     NTSTATUS status;
-    ULONG resultLength;
-    UNICODE_STRING valueName;
-    UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )];
-
-    Globals.DebugLevel = DEBUG_TRACE_ERROR;
-
-    RtlZeroMemory( &versionInfo, sizeof( versionInfo ) );
+    PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey;
+    UNICODE_STRING Subkey;
+    HANDLE ParametersKey = NULL;
+    HANDLE ServiceRegKey = NULL;
+    OBJECT_ATTRIBUTES Attributes;
 
     //
-    // Determine the OS version being run.
+    //  Open the parameters key to read values from the INF, using the API to
+    //  open the key if possible
     //
 
-    versionInfo.dwOSVersionInfoSize = sizeof( versionInfo );
+    pIoOpenDriverRegistryKey = CtxGetIoOpenDriverRegistryKey();
 
-    status = RtlGetVersion( &versionInfo );
+    if (pIoOpenDriverRegistryKey != NULL) {
 
-    if (!NT_SUCCESS( status )) {
+        //
+        //  Open the parameters key using the API
+        //
 
-        goto cleanup;
-    }
+        status = pIoOpenDriverRegistryKey( DriverObject,
+                                           DriverRegKeyParameters,
+                                           KEY_READ,
+                                           0,
+                                           &ParametersKey );
 
-    //
-    //  Open the desired registry key
-    //
+        if (!NT_SUCCESS( status )) {
+
+            goto cleanup;
+        }
+
+    } else {
 
-    if (versionInfo.dwBuildNumber >= 25952) {
         //
-        // Open the Parameters key for the service.
+        //  Open specified service root key
         //
 
-        status = IoOpenDriverRegistryKey( DriverObject,
-                                          DriverRegKeyParameters,
-                                          KEY_READ,
-                                          0,
-                                          &driverRegKey );
+        InitializeObjectAttributes( &Attributes,
+                                    ServiceRegistryPath,
+                                    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
+                                    NULL,
+                                    NULL );
+
+        status = ZwOpenKey( &ServiceRegKey,
+                            KEY_READ,
+                            &Attributes );
 
         if (!NT_SUCCESS( status )) {
 
             goto cleanup;
         }
-    } else {
+
         //
-        // Open legacy registry key.
+        //  Open the parameters key relative to service key path
         //
 
-        InitializeObjectAttributes( &attributes,
-                                    RegistryPath,
+        RtlInitUnicodeString( &Subkey, L"Parameters" );
+
+        InitializeObjectAttributes( &Attributes,
+                                    &Subkey,
                                     OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
-                                    NULL,
+                                    ServiceRegKey,
                                     NULL );
 
-        status = ZwOpenKey( &driverRegKey,
+        status = ZwOpenKey( &ParametersKey,
                             KEY_READ,
-                            &attributes );
+                            &Attributes );
 
         if (!NT_SUCCESS( status )) {
 
@@ -367,6 +421,71 @@ Return Value:
     }
 
     //
+    //  Return value to caller
+    //
+
+    *ServiceParametersKey = ParametersKey;
+
+cleanup:
+
+    if (ServiceRegKey != NULL) {
+
+        ZwClose( ServiceRegKey );
+    }
+
+    return status;
+
+}
+
+VOID
+CtxInitializeDebugLevel (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+    )
+/*++
+
+Routine Description:
+
+    This routine tries to read the filter DebugLevel parameter from
+    the registry.  This value will be found in the registry location
+    indicated by the RegistryPath passed in.
+
+Arguments:
+
+    DriverObject - Pointer to driver object created by the system to
+        represent this driver.
+
+    RegistryPath - The path key passed to the driver during DriverEntry.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    HANDLE driverRegKey = NULL;
+    NTSTATUS status;
+    ULONG resultLength;
+    UNICODE_STRING valueName;
+    UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )];
+
+    Globals.DebugLevel = DEBUG_TRACE_ERROR;
+
+    //
+    //  Open service parameters key to query values from.
+    //
+
+    status = CtxOpenServiceParametersKey( DriverObject,
+                                          RegistryPath,
+                                          &driverRegKey );
+
+    if (!NT_SUCCESS( status )) {
+
+        driverRegKey = NULL;
+        goto cleanup;
+    }
+
+    //
     // Read the DebugFlags value from the registry.
     //
 
diff --git a/filesys/miniFilter/ctx/ctx.inf b/filesys/miniFilter/ctx/ctx.inf
index e2e54fe7..8edaf764 100644
--- a/filesys/miniFilter/ctx/ctx.inf
+++ b/filesys/miniFilter/ctx/ctx.inf
diff --git a/filesys/miniFilter/delete/delete.inf b/filesys/miniFilter/delete/delete.inf
index 36186d35..da348874 100644
--- a/filesys/miniFilter/delete/delete.inf
+++ b/filesys/miniFilter/delete/delete.inf
diff --git a/filesys/miniFilter/minispy/minispy.inf b/filesys/miniFilter/minispy/minispy.inf
index cb6cda71..60eb8684 100644
--- a/filesys/miniFilter/minispy/minispy.inf
+++ b/filesys/miniFilter/minispy/minispy.inf
diff --git a/filesys/miniFilter/nullFilter/nullFilter.inf b/filesys/miniFilter/nullFilter/nullFilter.inf
index e35bc06c..c04e9f06 100644
--- a/filesys/miniFilter/nullFilter/nullFilter.inf
+++ b/filesys/miniFilter/nullFilter/nullFilter.inf
diff --git a/filesys/miniFilter/passThrough/passThrough.inf b/filesys/miniFilter/passThrough/passThrough.inf
index 0bb5e5fd..129a2ab6 100644
--- a/filesys/miniFilter/passThrough/passThrough.inf
+++ b/filesys/miniFilter/passThrough/passThrough.inf
diff --git a/filesys/miniFilter/scanner/filter/scanner.c b/filesys/miniFilter/scanner/filter/scanner.c
index 97cf5eb9..ec911f63 100644
--- a/filesys/miniFilter/scanner/filter/scanner.c
+++ b/filesys/miniFilter/scanner/filter/scanner.c
@@ -54,6 +54,28 @@ UNICODE_STRING ScannedExtensionDefault = RTL_CONSTANT_STRING( L"doc" );
 //  Function prototypes
 //
 
+typedef
+NTSTATUS
+(*PFN_IoOpenDriverRegistryKey) (
+    PDRIVER_OBJECT     DriverObject,
+    DRIVER_REGKEY_TYPE RegKeyType,
+    ACCESS_MASK        DesiredAccess,
+    ULONG              Flags,
+    PHANDLE            DriverRegKey
+    );
+
+PFN_IoOpenDriverRegistryKey
+ScannerGetIoOpenDriverRegistryKey (
+    VOID
+    );
+
+NTSTATUS
+ScannerOpenServiceParametersKey (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
+    );
+
 NTSTATUS
 ScannerInitializeScannedExtensions(
     _In_ PDRIVER_OBJECT DriverObject,
@@ -106,6 +128,8 @@ ScannerpCheckExtension (
 
 #ifdef ALLOC_PRAGMA
     #pragma alloc_text(INIT, DriverEntry)
+    #pragma alloc_text(INIT, ScannerGetIoOpenDriverRegistryKey)
+    #pragma alloc_text(INIT, ScannerOpenServiceParametersKey)
     #pragma alloc_text(INIT, ScannerInitializeScannedExtensions)
     #pragma alloc_text(PAGE, ScannerInstanceSetup)
     #pragma alloc_text(PAGE, ScannerPreCreate)
@@ -313,17 +337,36 @@ Return Value:
 }
 
 
+PFN_IoOpenDriverRegistryKey
+ScannerGetIoOpenDriverRegistryKey (
+    VOID
+    )
+{
+    static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL;
+    UNICODE_STRING FunctionName = {0};
+
+    if (pIoOpenDriverRegistryKey == NULL) {
+
+        RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey");
+
+        pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName);
+    }
+
+    return pIoOpenDriverRegistryKey;
+}
+
 NTSTATUS
-ScannerInitializeScannedExtensions(
+ScannerOpenServiceParametersKey (
     _In_ PDRIVER_OBJECT DriverObject,
-    _In_ PUNICODE_STRING RegistryPath
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
     )
 /*++
 
-Routine Descrition:
+Routine Description:
 
-    This routine sets the the extensions for files to be scanned based
-    on the registry.
+    This routine opens the service parameters key, using the isolation-compliant
+    APIs when possible.
 
 Arguments:
 
@@ -332,6 +375,8 @@ Arguments:
 
     RegistryPath - The path key passed to the driver during DriverEntry.
 
+    ServiceParametersKey - Returns a handle to the service parameters subkey.
+
 Return Value:
 
     STATUS_SUCCESS if the function completes successfully.  Otherwise a valid
@@ -340,79 +385,150 @@ Return Value:
 --*/
 {
     NTSTATUS status;
-    OBJECT_ATTRIBUTES attributes;
-    OSVERSIONINFOW versionInfo;
-    HANDLE driverRegKey = NULL;
-    UNICODE_STRING valueName;
-    PKEY_VALUE_PARTIAL_INFORMATION valueBuffer = NULL;
-    ULONG valueLength = 0;
-    BOOLEAN closeHandle = FALSE;
-    PWCHAR ch;
-    SIZE_T length;
-    ULONG count;
-    PUNICODE_STRING ext;
-
-    PAGED_CODE();
-
-    ScannedExtensions = NULL;
-    ScannedExtensionCount = 0;
-
-    RtlZeroMemory( &versionInfo, sizeof( versionInfo ) );
+    PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey;
+    UNICODE_STRING Subkey;
+    HANDLE ParametersKey = NULL;
+    HANDLE ServiceRegKey = NULL;
+    OBJECT_ATTRIBUTES Attributes;
 
     //
-    // Determine the OS version being run.
+    //  Open the parameters key to read values from the INF, using the API to
+    //  open the key if possible
     //
 
-    versionInfo.dwOSVersionInfoSize = sizeof( versionInfo );
+    pIoOpenDriverRegistryKey = ScannerGetIoOpenDriverRegistryKey();
 
-    status = RtlGetVersion( &versionInfo );
+    if (pIoOpenDriverRegistryKey != NULL) {
 
-    if (!NT_SUCCESS( status )) {
+        //
+        //  Open the parameters key using the API
+        //
 
-        goto ScannerInitializeScannedExtensionsCleanup;
-    }
+        status = pIoOpenDriverRegistryKey( DriverObject,
+                                           DriverRegKeyParameters,
+                                           KEY_READ,
+                                           0,
+                                           &ParametersKey );
 
-    //
-    //  Open the desired registry key
-    //
+        if (!NT_SUCCESS( status )) {
+
+            goto ScannerOpenServiceParametersKeyCleanup;
+        }
+
+    } else {
 
-    if (versionInfo.dwBuildNumber >= 25952) {
         //
-        // Open the Parameters key for the service.
+        //  Open specified service root key
         //
 
-        status = IoOpenDriverRegistryKey( DriverObject,
-                                          DriverRegKeyParameters,
-                                          KEY_READ,
-                                          0,
-                                          &driverRegKey );
+        InitializeObjectAttributes( &Attributes,
+                                    ServiceRegistryPath,
+                                    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
+                                    NULL,
+                                    NULL );
+
+        status = ZwOpenKey( &ServiceRegKey,
+                            KEY_READ,
+                            &Attributes );
 
         if (!NT_SUCCESS( status )) {
 
-            goto ScannerInitializeScannedExtensionsCleanup;
+            goto ScannerOpenServiceParametersKeyCleanup;
         }
-    } else {
+
         //
-        // Open legacy registry key.
+        //  Open the parameters key relative to service key path
         //
 
-        InitializeObjectAttributes( &attributes,
-                                    RegistryPath,
+        RtlInitUnicodeString( &Subkey, L"Parameters" );
+
+        InitializeObjectAttributes( &Attributes,
+                                    &Subkey,
                                     OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
-                                    NULL,
+                                    ServiceRegKey,
                                     NULL );
 
-        status = ZwOpenKey( &driverRegKey,
+        status = ZwOpenKey( &ParametersKey,
                             KEY_READ,
-                            &attributes );
+                            &Attributes );
 
         if (!NT_SUCCESS( status )) {
 
-            goto ScannerInitializeScannedExtensionsCleanup;
+            goto ScannerOpenServiceParametersKeyCleanup;
         }
     }
 
-    closeHandle = TRUE;
+    //
+    //  Return value to caller
+    //
+
+    *ServiceParametersKey = ParametersKey;
+
+ScannerOpenServiceParametersKeyCleanup:
+
+    if (ServiceRegKey != NULL) {
+
+        ZwClose( ServiceRegKey );
+    }
+
+    return status;
+
+}
+
+NTSTATUS
+ScannerInitializeScannedExtensions(
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+    )
+/*++
+
+Routine Descrition:
+
+    This routine sets the the extensions for files to be scanned based
+    on the registry.
+
+Arguments:
+
+    DriverObject - Pointer to driver object created by the system to
+        represent this driver.
+
+    RegistryPath - The path key passed to the driver during DriverEntry.
+
+Return Value:
+
+    STATUS_SUCCESS if the function completes successfully.  Otherwise a valid
+    NTSTATUS code is returned.
+
+--*/
+{
+    NTSTATUS status;
+    HANDLE driverRegKey = NULL;
+    UNICODE_STRING valueName;
+    PKEY_VALUE_PARTIAL_INFORMATION valueBuffer = NULL;
+    ULONG valueLength = 0;
+    PWCHAR ch;
+    SIZE_T length;
+    ULONG count;
+    PUNICODE_STRING ext;
+
+    PAGED_CODE();
+
+    ScannedExtensions = NULL;
+    ScannedExtensionCount = 0;
+
+    //
+    //  Open service parameters key to query values from.
+    //
+
+    status = ScannerOpenServiceParametersKey( DriverObject,
+                                              RegistryPath,
+                                              &driverRegKey );
+
+    if (!NT_SUCCESS( status )) {
+
+        driverRegKey = NULL;
+        goto ScannerInitializeScannedExtensionsCleanup;
+    }
 
     //
     //   Query the length of the reg value
@@ -522,7 +638,7 @@ ScannerInitializeScannedExtensionsCleanup:
         valueBuffer = NULL;
     }
 
-    if (closeHandle) {
+    if (driverRegKey != NULL) {
 
         ZwClose( driverRegKey );
     }
diff --git a/filesys/miniFilter/scanner/scanner.inf b/filesys/miniFilter/scanner/scanner.inf
index c872e928..d7bf6256 100644
--- a/filesys/miniFilter/scanner/scanner.inf
+++ b/filesys/miniFilter/scanner/scanner.inf
diff --git a/filesys/miniFilter/simrep/simrep.c b/filesys/miniFilter/simrep/simrep.c
index 278555d9..f23dddd6 100644
--- a/filesys/miniFilter/simrep/simrep.c
+++ b/filesys/miniFilter/simrep/simrep.c
@@ -243,6 +243,28 @@ DriverEntry (
     _In_ PUNICODE_STRING RegistryPath
     );
 
+typedef
+NTSTATUS
+(*PFN_IoOpenDriverRegistryKey) (
+    PDRIVER_OBJECT     DriverObject,
+    DRIVER_REGKEY_TYPE RegKeyType,
+    ACCESS_MASK        DesiredAccess,
+    ULONG              Flags,
+    PHANDLE            DriverRegKey
+    );
+
+PFN_IoOpenDriverRegistryKey
+SimRepGetIoOpenDriverRegistryKey (
+    VOID
+    );
+
+NTSTATUS
+SimRepOpenServiceParametersKey (
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
+    );
+
 NTSTATUS
 SimRepSetConfiguration(
     _In_ PDRIVER_OBJECT DriverObject,
@@ -507,6 +529,8 @@ SIMREP_GLOBAL_DATA Globals;
 
 #ifdef ALLOC_PRAGMA
 #pragma alloc_text(INIT, DriverEntry)
+#pragma alloc_text(INIT, SimRepGetIoOpenDriverRegistryKey)
+#pragma alloc_text(INIT, SimRepOpenServiceParametersKey)
 #pragma alloc_text(INIT, SimRepSetConfiguration)
 #pragma alloc_text(PAGE, SimRepUnload)
 #pragma alloc_text(PAGE, SimRepInstanceSetup)
@@ -665,16 +689,36 @@ DriverEntryCleanup:
 }
 #pragma warning(pop)
 
+PFN_IoOpenDriverRegistryKey
+SimRepGetIoOpenDriverRegistryKey (
+    VOID
+    )
+{
+    static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL;
+    UNICODE_STRING FunctionName = {0};
+
+    if (pIoOpenDriverRegistryKey == NULL) {
+
+        RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey");
+
+        pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName);
+    }
+
+    return pIoOpenDriverRegistryKey;
+}
+
 NTSTATUS
-SimRepSetConfiguration(
+SimRepOpenServiceParametersKey (
     _In_ PDRIVER_OBJECT DriverObject,
-    _In_ PUNICODE_STRING RegistryPath
+    _In_ PUNICODE_STRING ServiceRegistryPath,
+    _Out_ PHANDLE ServiceParametersKey
     )
 /*++
 
-Routine Descrition:
+Routine Description:
 
-    This routine sets the filter configuration based on registry values.
+    This routine opens the service parameters key, using the isolation-compliant
+    APIs when possible.
 
 Arguments:
 
@@ -683,84 +727,158 @@ Arguments:
 
     RegistryPath - The path key passed to the driver during DriverEntry.
 
-Return Value:
+    ServiceParametersKey - Returns a handle to the service parameters subkey.
 
-    Returns the status of this operation.
+Return Value:
 
+    STATUS_SUCCESS if the function completes successfully.  Otherwise a valid
+    NTSTATUS code is returned.
 
 --*/
 {
     NTSTATUS status;
-    OBJECT_ATTRIBUTES attributes;
-    OSVERSIONINFOW versionInfo;
-    HANDLE driverRegKey = NULL;
-    UNICODE_STRING valueName;
-    UCHAR buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG)];
-    PKEY_VALUE_PARTIAL_INFORMATION value = (PKEY_VALUE_PARTIAL_INFORMATION)buffer;
-    ULONG valueLength = sizeof(buffer);
-    ULONG resultLength;
-    PKEY_VALUE_PARTIAL_INFORMATION mappingValue = NULL;
-    ULONG mappingValueLength = 0;
-    WCHAR oldMappingTail;
-    WCHAR newMappingTail;
-
-    PAGED_CODE();
-
-    RtlZeroMemory( &versionInfo, sizeof( versionInfo ) );
+    PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey;
+    UNICODE_STRING Subkey;
+    HANDLE ParametersKey = NULL;
+    HANDLE ServiceRegKey = NULL;
+    OBJECT_ATTRIBUTES Attributes;
 
     //
-    // Determine the OS version being run.
+    //  Open the parameters key to read values from the INF, using the API to
+    //  open the key if possible
     //
 
-    versionInfo.dwOSVersionInfoSize = sizeof( versionInfo );
+    pIoOpenDriverRegistryKey = SimRepGetIoOpenDriverRegistryKey();
 
-    status = RtlGetVersion( &versionInfo );
+    if (pIoOpenDriverRegistryKey != NULL) {
 
-    if (!NT_SUCCESS( status )) {
+        //
+        //  Open the parameters key using the API
+        //
 
-        goto SimRepSetConfigurationCleanup;
-    }
+        status = pIoOpenDriverRegistryKey( DriverObject,
+                                           DriverRegKeyParameters,
+                                           KEY_READ,
+                                           0,
+                                           &ParametersKey );
 
-    //
-    //  Open the desired registry key
-    //
+        if (!NT_SUCCESS( status )) {
+
+            goto SimRepOpenServiceParametersKeyCleanup;
+        }
+
+    } else {
 
-    if (versionInfo.dwBuildNumber >= 25952) {
         //
-        // Open the Parameters key for the service.
+        //  Open specified service root key
         //
 
-        status = IoOpenDriverRegistryKey( DriverObject,
-                                          DriverRegKeyParameters,
-                                          KEY_READ,
-                                          0,
-                                          &driverRegKey );
+        InitializeObjectAttributes( &Attributes,
+                                    ServiceRegistryPath,
+                                    OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
+                                    NULL,
+                                    NULL );
+
+        status = ZwOpenKey( &ServiceRegKey,
+                            KEY_READ,
+                            &Attributes );
 
         if (!NT_SUCCESS( status )) {
 
-            goto SimRepSetConfigurationCleanup;
+            goto SimRepOpenServiceParametersKeyCleanup;
         }
-    } else {
+
         //
-        // Open legacy registry key.
+        //  Open the parameters key relative to service key path
         //
 
-        InitializeObjectAttributes( &attributes,
-                                    RegistryPath,
+        RtlInitUnicodeString( &Subkey, L"Parameters" );
+
+        InitializeObjectAttributes( &Attributes,
+                                    &Subkey,
                                     OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
-                                    NULL,
+                                    ServiceRegKey,
                                     NULL );
 
-        status = ZwOpenKey( &driverRegKey,
+        status = ZwOpenKey( &ParametersKey,
                             KEY_READ,
-                            &attributes );
+                            &Attributes );
 
         if (!NT_SUCCESS( status )) {
 
-            goto SimRepSetConfigurationCleanup;
+            goto SimRepOpenServiceParametersKeyCleanup;
         }
     }
 
+    //
+    //  Return value to caller
+    //
+
+    *ServiceParametersKey = ParametersKey;
+
+SimRepOpenServiceParametersKeyCleanup:
+
+    if (ServiceRegKey != NULL) {
+
+        ZwClose( ServiceRegKey );
+    }
+
+    return status;
+
+}
+
+NTSTATUS
+SimRepSetConfiguration(
+    _In_ PDRIVER_OBJECT DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+    )
+/*++
+
+Routine Descrition:
+
+    This routine sets the filter configuration based on registry values.
+
+Arguments:
+
+    DriverObject - Pointer to driver object created by the system to
+        represent this driver.
+
+    RegistryPath - The path key passed to the driver during DriverEntry.
+
+Return Value:
+
+    Returns the status of this operation.
+
+
+--*/
+{
+    NTSTATUS status;
+    HANDLE driverRegKey = NULL;
+    UNICODE_STRING valueName;
+    UCHAR buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG)];
+    PKEY_VALUE_PARTIAL_INFORMATION value = (PKEY_VALUE_PARTIAL_INFORMATION)buffer;
+    ULONG valueLength = sizeof(buffer);
+    ULONG resultLength;
+    PKEY_VALUE_PARTIAL_INFORMATION mappingValue = NULL;
+    ULONG mappingValueLength = 0;
+    WCHAR oldMappingTail;
+    WCHAR newMappingTail;
+
+    PAGED_CODE();
+
+    //
+    //  Open service parameters key to query values from
+    //
+
+    status = SimRepOpenServiceParametersKey( DriverObject,
+                                             RegistryPath,
+                                             &driverRegKey );
+
+    if (!NT_SUCCESS( status )) {
+
+        driverRegKey = NULL;
+        goto SimRepSetConfigurationCleanup;
+    }
 
 #if DBG
 
diff --git a/filesys/miniFilter/simrep/simrep.inf b/filesys/miniFilter/simrep/simrep.inf
index 104b6863..8eea42ce 100644
--- a/filesys/miniFilter/simrep/simrep.inf
+++ b/filesys/miniFilter/simrep/simrep.inf
diff --git a/filesys/miniFilter/swapBuffers/swapBuffers.inf b/filesys/miniFilter/swapBuffers/swapBuffers.inf
index a64bef9d..0aab9452 100644
--- a/filesys/miniFilter/swapBuffers/swapBuffers.inf
+++ b/filesys/miniFilter/swapBuffers/swapBuffers.inf