No, it’s not NTFS, it’s the file system filter architecture of the NT kernel.
I had internalised that it was Windows Defender hooking every file operation and checking it against a blacklist? I've had it forced off for years.
This guy gets it. Yes bingo. It's the VFS' filters/ACLs support afaik.
I had internalised that it was Windows Defender hooking every file operation and checking it against a blacklist? I've had it forced off for years.