Solution of the IoDeleteSymbolicLink issue

Yesterday, I faced with the IoDeleteSymbolicLink issue. Alexander A. Telyatnikov suggested me an idea that helped me to solve that issue.

The cause of the issue consists in the existing of multiple instances of the \DosDevices directory, where I created the symbolic link. Each of the user logged in has a distinct instance. The system operates with its own global instance of the \DosDevices, which is the alias of the \Global?? directory.

I created the symbolic link in the IRP_MJ_DEVICE_CONTROL handler, which is executed in an user process context. So the link was created in one of the users' \DosDevices directories, each of those have the \?? alias. However the DriverUnload routine is executed in the system context, so the link is being deleted from the \Global?? directory. Since there is no links with the specified name the IoDeleteSymbolicLink returns the STATUS_OBJECT_NAME_NOT_FOUND status code.

There is a good article that explains the difference between the local and global instances of the \DosDevices directory.

On the whole, to solve this issue I changed the link path from the \DosDevices to the \DosDevices\Global. Thus, the symbolic link to the device object is always created in the global \DosDevice directory, which is the same for different execution contexts.