The product development team recommends that you uninstall any third party file-based encryption applications that aren't compatible with a layered file system model. If you fail to uninstall incompatible third-party applications, it can lead to data corruption. A user application might operate on the decrypted form of the data and then flush the modified data from memory back to disk.
Why is this behavior associated with updates to VSE?
VSE uses a driver technology called a 'file system filter driver.' It intercepts the opening and closing of all files on the system to perform on-access antivirus scans. The Windows operating system creates a 'stack' of filter drivers. Flawed file encryption drivers are sensitive to their location in this stack. The location exposes the data corruption problem if they're above the VSE filter driver in the stack.
The Microsoft Filter Manager provides the VSE filter with a consistent and predictable location in the filter stack. Microsoft assigns the VSE location within this stack through a "filter altitude" value that's specific to VSE. This value can't be changed. Sometimes, the location of the VSE filter is below the filters for the encryption software. In the past, VSE used a more traditional file system filter technology that tended to be at the top of the file system filter stack.
For security purposes, the product development team doesn't use encryption software that places filters above VSE. When VSE is below the encryption software in the filter stack, it only sees the encrypted data and doesn't function properly, putting the system at risk of infection and data corruption.
IMPORTANT: Other products unrelated to antivirus, such as backup applications, also use filter drivers. They can expose the same problem in a file encryption product that doesn't implement the layered file system model. VSE is unable to work around encryption products that don't implement the layered file system model. The reason is that the compatibility issue exists between the encryption product and the Windows family of operating systems. So, we recommend that you don't use file encryption products that don't implement the layered file system model alongside VSE. They aren't compatible with the technical requirements of the Windows operating systems.
We conform with the best practices as outlined in the Windows Logo Kit, and are committed to the mini-filter model design change. Endpoint Encryption is an example of a file encryption product that implements the layered file system model.
