1. Upper filters are drivers that process/filter device access requests from programs before sending them on to the primary device driver. Lower filters are drivers that handle/filter device access requests from the primary device driver before they are passed to the kernel driver. Device drivers often have a default filter, which is used if you omit the filter parameter in a call to a routine that takes it.
Upper filters can be useful when writing device drivers that work with multiple operating systems or kernel versions. For example, an upper filter could validate OS-specific identifiers such as IOCTLs before passing them on to the primary device driver. Lower filters can be used to change device settings such as the IRQ priority. Both types of filter can also be used to log events as they are processed.
In Windows, all device drivers must be either low-level drivers or high-level drivers. Low-level drivers cannot request any higher privileges than those given to them by Windows. High-level drivers request a greater range of privileges than what is available to low-level drivers. The most common high-level drivers include disk drivers (such as FDD and HDD), sound drivers (such as Audio Capture Drivers and MIDI Devices), and network drivers (such as TCP/IP and USB).
A low-level driver is one that is not a high-level driver.
Devices may not function correctly if the upper and lower filters are removed. Everything is determined by the higher and lower drivers. Some are mandatory, while others are optional (provided as an alternative device access method). Both upper and lower filters are used by Windows. This discussion has been closed and no more replies will be accepted.
UpperFilters and LowerFilters values, sometimes wrongly referred to as "upper and lower filters," may exist in the registry for numerous device classes, but those values in the DVD/CD-ROM Drives class tend to corrupt and cause issues the most frequently. These are two of the most common faults drivers encounter - usually due to a malfunctioning driver update or installation attempt.
The UpperFilters value is used by the Registry to determine which subkeys of HKEY_LOCAL_MACHINE should be used to search when looking for a particular string value. By default, only the first 12 keys are searched when looking for a value. You can increase this number in cases where you have large numbers of strings stored in the registry.
The LowerFilters value is used by the Registry to determine which subkeys of HKEY_LOCAL_MACHINE should be ignored when looking for a particular string value. By default, the last three keys (0x400 - 0x407) are ignored by the Registry if they do not contain any string values. These keys are commonly referred to as "dead keys" because they do not contain any useful information. You can add additional dead keys to this list by using the reg add command with the /d key.
It's important to note that changing these values will likely cause issues with other programs on your system.
The most common active filters are