Fix STATUS_FLT_DO_NOT_ATTACH 0xC01C000F Error

You hit the STATUS_FLT_DO_NOT_ATTACH error and your volume or drive isn't working right.

It's annoying, especially when you're trying to mount an external drive or run a backup. The good news: this is almost always fixable in under 10 minutes. Here's the fix that works for most people.

The fix: detach orphaned filters with fltmc

Open a Command Prompt as Administrator. Then run:

fltmc instances

Look for any volume with a filter instance that shows an error or a weird state (like "detaching" or "failed"). Note the name of the filter and the volume. Then detach it:

fltmc detach [FilterName] [VolumeName]

Example: if you see MyFilter on C:, run fltmc detach MyFilter C:. You might need to repeat this for all volumes showing problems.

After that, reboot. The error should be gone.

Why this works

What's actually happening here is the Windows Filter Manager (part of the OS since Vista) keeps track of which filter drivers are attached to each volume. When a filter crashes or is removed improperly — say, you uninstalled an antivirus or backup tool that didn't clean up after itself — the Filter Manager still has a stale instance entry. When the driver tries to reattach (either at boot or when you mount the volume), the Filter Manager sees that the volume is already supposed to have a filter attached, so it returns STATUS_FLT_DO_NOT_ATTACH to prevent duplicate attachments. The fltmc detach command tells the Filter Manager to forget that stale entry.

Less common variations and deeper fixes

Registry cleanup

If fltmc detach doesn't work (maybe the filter is so broken it doesn't even show up), you can try a registry cleanup. This is a bit riskier, so back up the registry first.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<FilterName>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FltMgr\Instances

Look under FltMgr\Instances for any instance that references a volume that shouldn't have a filter. Delete that instance key. Reboot.

The reason step 3 works is the Filter Manager reads its instance database from the registry at boot. If the registry entry is corrupt or points to a non-existent filter, the Filter Manager gets confused. Purging the orphaned key lets it start fresh.

Antivirus or backup software conflict

This error pops up often with security software that uses filter drivers (like McAfee, Norton, or older versions of Acronis). If you recently updated or uninstalled one of these, the filter might not have been properly detached. In that case, reinstall the software, then properly uninstall it using the vendor's removal tool. Afterwards, run fltmc instances again to confirm the filter is gone.

Filter driver corruption

If none of the above clears it, the filter driver itself might be corrupt. Check the System Event Log for filter-related errors. Look at the FilterManager source. If you see messages about a specific driver failing to load, try disabling it via sc config [FilterName] start= disabled and reboot. If the volume works after that, you've found the culprit. Then you can uninstall the software that owns that driver.

Prevention: avoid these common pitfalls

Always uninstall security software properly — use the vendor's uninstaller, not just deleting folders. Many of these tools install filter drivers that need a clean teardown.
Before you uninstall backup software, check if it has a "remove filter driver" option or run its cleanup tool first. Acronis, for example, often leaves filter instances behind.
Keep your filter manager healthy — run sfc /scannow occasionally to check system file integrity, including fltmgr.sys.
If you're a developer writing filter drivers, always call FltDetachVolume in your unload routine. Don't rely on the system to clean up after you.

That's it. The fltmc detach route fixes 90% of cases. For the rest, the registry or software reinstall handles it. You don't need any third-party tools — just the commands above and a bit of patience.