For the first release I want to avoid the custom driver build due to costs for the code signing certificate. My actual solution: I use a named semaphore in Global-Namespace in CNdisApi class. If the semaphore does not exist it is created in CNdisApi constructor with high initial count, otherwise it is opened. The semaphore counter is decremented whenever the driver has been successfully loaded by CreateFile and is incremented when the driver handle is closed in CNdisApi destructor. So I can check with a custom action in setup before uninstall if the named semaphore does exist or not. So I can inhibt uninstall of ndisrd.sys when in use by my NAT service. The challenge was creating the security attribute of the semaphore for the different users (service account, admin etc.) and use of Global-Namespace.
For series production it makes sense to use a custom driver build of WinPkFilter driver but I like the possibility to use different setups for the NAT service app and the NDIS filter driver for service purposes.
