Minifilter Driver - detecting IO operations initiated remotely to local shared folders

NTFSD
1

hi OSR Community,

I wrote a minifilter driver for one of my projects and i want it to behave differently when handling requests locally vs remote requests

is there any function/flag/alignment that can help me differentiate whether a Write operation is from a local user writing to file or if someone is writing to a file inside a shared folder over SMB ?

2

Do you mean whether the operation is from SRV? I’m pretty sure that there is a registry setting which causes SRV to garnish the requests with an ECP.

This might be it

1 Like
3

@rod_widdowson said:
Do you mean whether the operation is from SRV? I’m pretty sure that there is a registry setting which causes SRV to garnish the requests with an ECP.

This might be it

this is an ECP you will get if you are the computer requesting a read from another computer
I’m trying to find the ECP that is given to the callback in the computer that is requested from (the computer that shared the folder)

4

Try this link and look for Christian’s comment

1 Like
5

thank you very much @rod_widdowson, it worked ! :smiley: