clfs authentication

CLFS authentication refers to Microsoft's host-based integrity check for the Common Log File System (CLFS) driver, which attaches HMACs to Base Log Files (.blf) and container files. This hardening validates authentication codes on open and, after a 90-day learning period, refuses to parse logfiles without valid authentication. The change hardens kernel parsing against forged or tampered files but introduces operational and forensic consequences for administrators and log collectors. Topics include the 90-day adoption window, fsutil clfs authenticate tooling, and registry/Group Policy controls to avoid service disruptions.