title: how to handle IRP_MN_QUERY_DEVICE_RELATIONS in USB filter driver
body: <p>I am new in driver development.
  I started to develop usb filter driver for Windows7 in order to hide from user some usb device types. I attach my driver on USB hub and can intercept IRP_MN_QUERY_DEVICE_RELATIONS. I have a few questions:</p>
  
  <p>1 - On <code>IRP_MN_QUERY_DEVICE_RELATIONS</code> (<code>QueryDeviceRelations.Type</code> is BusRelations) I receive a pointer to <code>DEVICE_RELATIONS struct</code>.As I understand the Objects array in the struct should hold pointers to PDOs. But, when I test <code>DO_BUS_ENUMERATED_DEVICE</code> flag (From msdn: <em>The operating system sets this flag in each physical device object (PDO). Drivers must not modify this flag.</em>) sometime I see this flag is turned on, and some time the flag is turned off. Does it means that sometime I see PDO and sometime I see FDO? Or some another explanation for this issue? When I get some <code>PDEVICE_OBJECT</code>, how can I know Is it PDO or FDO?</p>
  
  <p>2 - When the user plugs in some usb device, and the filter driver should handle <code>IRP_MN_QUERY_DEVICE_RELATIONS</code>, how can I determine which device from Object array is just now plugged in device and which one was plugged in before, and which one is marked as inactive?</p>
  
  <p>Thanks in advance.
  Felix.</p>