Windows 2000 driver issues

I’ve got a simple device driver that I used under NT4 to accomplish a few
things, but I’m finding various issues using it with Win2000. Hopefully
someone here can answer some of my questions.

Under NT4, many of the Lsa logon APIs could only be called from kernel
mode, since they were only implemented in NTOSKRNL.EXE. Under Windows
2000, these APIs are now part of SECUR32.DLL. Do the APIs no longer work
when called from kernel mode in a device driver? I’m getting an error
back from “LsaRegisterLogonProcess”, but I don’t get this error from NT4.
I can certainly implement a DLL to call them from SECUR32.DLL (I like
using a user-mode DLL more anyway), but I don’t want to find the same
problem – is there some documentation about what changed with this API?

Secondly, my driver is used ONLY by my service – at startup, I load the
driver, and at shutdown, I unload the driver (and in fact, attempt to
uninstall it). This all works fine on NT4.

However, under Win2000, my driver often fails to load or unload. I
haven’t been able to figure out the exact error that’s occurring. Are
there any special tricks to installing/loading/unloading/uninstalling
device drivers under Win2000?

Finally, I find that when my device driver does get installed and loaded,
if I go to the “Device Manager” section of “Computer Managment”, and
select “Show Hidden Devices”, and select my device from the “Non Plug And
Play Devices” list, and choose “Properties”, I see this:

Device Type: Non-Plug and Play Drivers

Manufacturer: Unknown

Location: Unknown

This device is not present, is not working properly, or does not
have all its drivers installed (Code 24).

Why is it reporting this error? Is there some driver routine I’m not
supporting properly? Also, what do I need to do in order for my name to
show up in the Manufacturer and Location fields?

Thanks tons for any help!

Rob


Rob Newberry
Director of Fajita Technology
Group Logic, Inc.

> Under NT4, many of the Lsa logon APIs could only be called from kernel

mode, since they were only implemented in NTOSKRNL.EXE. Under

No. They implemented in ADVAPI32.DLL also. All of them - both kernel and
user mode - are sending packets to \LsaAuthenticationPort serviced by
LSASS process.

Max

> > Under NT4, many of the Lsa logon APIs could only be called from kernel

> mode, since they were only implemented in NTOSKRNL.EXE. Under

No. They implemented in ADVAPI32.DLL also. All of them - both kernel and
user mode - are sending packets to \LsaAuthenticationPort serviced by
LSASS process.

I cannot find any implementation of

LsaLogonUser
LsaRegisterLogonProcess
LsaDeregisterLogonProcess
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer

in ADVAPI32.DLL.

Some of the LSA APIs are indeed handled by ADVAPI32.DLL, but not the ones
I need.

Rob


Rob Newberry
Director of Fajita Technology
Group Logic, Inc.

> LsaLogonUser

LsaRegisterLogonProcess
LsaDeregisterLogonProcess
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer

in ADVAPI32.DLL.

Sorry. But I definitely saw all of them in some umode DLL.
LsaRegisterLogonProcess connects to \LsaAuthenticationPort, and other
functions send messages to them.

Max

> > LsaLogonUser

> LsaRegisterLogonProcess
> LsaDeregisterLogonProcess
> LsaCallAuthenticationPackage
> LsaLookupAuthenticationPackage
> LsaFreeReturnBuffer
>
> in ADVAPI32.DLL.

Sorry. But I definitely saw all of them in some umode DLL.
LsaRegisterLogonProcess connects to \LsaAuthenticationPort, and other
functions send messages to them.

Under Windows 2000, they are all implemented in SECUR32.DLL, but that DLL
isn’t on NT4. The documentation for the routines say to use SECUR32.LIB
– perhaps you can install SECUR32.DLL on NT4 if you want to?

Rob


Rob Newberry
Director of Fajita Technology
Group Logic, Inc.