[This documentation is preliminary and is subject to change.]

The FwpsClassifyUser0 function is used to classify against a user-mode layer.

DWORD FwpsClassifyUser0(
  HANDLE engineHandle,
  UINT16 layerId,
  const FWPS_INCOMING_VALUES0* inFixedValues,
  const FWPS_INCOMING_METADATA_VALUES0* inMetadataValues,
  const void* layerData,
  FWPS_CLASSIFY_OUT0* classifyOut


  • engineHandle
    [in] A handle for an open session to a filter engine. An application calls the FwpmEngineOpen0 function to open a session to a filter engine.
  • layerId
    [in] Layer ID from the built-in set of WFP constants.
  • inFixedValues
    [in] Incoming data values specified by FWPS_INCOMING_VALUES0.
  • inMetadataValues
    [in] Incoming metadata values specified by FWPS_INCOMING_METADATA_VALUES0.
  • layerData
    [in, out] Pointer must be NULL at this time.
  • classifyOut
    [out] Pointer to outcome of shim classification. See FWPS_CLASSIFY_OUT0 for more information.

Return Value

If the function succeeds, the return value is ERROR_SUCCESS.

If the method fails, the return value may be one of the following return codes.

An RPC_* error may be due to a failure to communicate with the remote or local filter engine.

Return code Description
ERROR_ACCESS_DENIED Returned in response to a delete operation on built-in object, such as the IPsec callout, or from a write operation within an explicit read transaction, or from a non-transactional call within any explicit transaction.

Also applies to general access/security issues.

ERROR_ALREADY_EXISTS Attempt to add an object with a GUID that matches an existing object of the same type.
ERROR_BUSY Attempting to delete an object that's referenced by another object; for example, deleting a callout that's referenced by a filter.
ERROR_CALL_NOT_IMPLEMENTED API call not implemented.
ERROR_FILE_NOT_FOUND Get/Delete called for a LUID/GUID that does not exist. Also, returned by Add if the object being added references a non-existent object; for example, trying to add a filter to a non-existent layer.
ERROR_INVALID_HANDLE Attempting to reference a callout from a filter in a different layer.
ERROR_NOT_ENOUGH_MEMORY Virtual memory exhausted.
ERROR_NOT_SUPPORTED Generally, some combination of flags, etc. that are not allowed.
ERROR_TIMEOUT Timed out trying to acquire the transaction lock or forcibly aborted for holding the transaction lock too long.


Server Requires Windows ServerĀ "Longhorn".

Declared in Fwpsu.h.


Use Fwpuclnt.lib.

DLL Requires Fwpuclnt.dll.

See Also

Windows Filtering Platform API Reference
Windows Filtering Platform API Functions
Management Functions