AW: Re: AW: impersonating

NTDEV
1

Maybe i’m missing something here, but if
NtOpenThreadToken returned a token,
the thread is impersonating.

hth,

Holger Thiele
D.A.V.I.D. GmbH
xxxxx@david-gmbh.de

-----Ursprungliche Nachricht-----
Von: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Gesendet: Donnerstag, 7. Februar 2002 14:18
An: NT Developers Interest List
Betreff: [ntdev] Re: AW: impersonating

I mean when I have token opened how can I know if thread is
impersonating?

Alexey Logachyov
xxxxx@vba.com.by
VirusBlokAda ltd.
http://www.vba.com.by

----- Original Message -----
From: “Holger Thiele”
>To: “NT Developers Interest List”
>Sent: Thursday, February 07, 2002 12:37 PM
>Subject: [ntdev] AW: impersonating
>
>
>> You mean other than the undoc’ed NtOpenThreadToken?
>>
>> cheers,
>>
>> Holger Thiele
>> D.A.V.I.D. GmbH
>> xxxxx@david-gmbh.de
>>
>>
>> >-----Ursprungliche Nachricht-----
>> >Von: Alexey Logachyov [mailto:xxxxx@vba.com.by]
>> >Gesendet: Donnerstag, 7. Februar 2002 09:57
>> >An: NT Developers Interest List
>> >Betreff: [ntdev] impersonating
>> >
>> >
>> >How can I know if a requesting thread is impersonating?
>> >
>> >Alexey Logachyov
>> >xxxxx@vba.com.by
>> >VirusBlokAda ltd.
>> >http://www.vba.com.by
>> >
>> >
>> >
>> >—
>> >You are currently subscribed to ntdev as: xxxxx@david-gmbh.de
>> >To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>> >
>>
>> —
>> You are currently subscribed to ntdev as: xxxxx@vba.com.by
>> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@david-gmbh.de
>To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Thread has both primary token and impersonation token.
Thread is impersonating if its impersonation token is not NULL.
Primary token is always nonNULL - this is the process’s token.

Max

----- Original Message -----
From: “Alexey Logachyov”
To: “NT Developers Interest List”
Sent: Thursday, February 07, 2002 4:18 PM
Subject: [ntdev] Re: AW: impersonating

> I mean when I have token opened how can I know if thread is impersonating?
>
> Alexey Logachyov
> xxxxx@vba.com.by
> VirusBlokAda ltd.
> http://www.vba.com.by
>
> ----- Original Message -----
> From: “Holger Thiele”
> To: “NT Developers Interest List”
> Sent: Thursday, February 07, 2002 12:37 PM
> Subject: [ntdev] AW: impersonating
>
>
> > You mean other than the undoc’ed NtOpenThreadToken?
> >
> > cheers,
> >
> > Holger Thiele
> > D.A.V.I.D. GmbH
> > xxxxx@david-gmbh.de
> >
> >
> > >-----Ursprungliche Nachricht-----
> > >Von: Alexey Logachyov [mailto:xxxxx@vba.com.by]
> > >Gesendet: Donnerstag, 7. Februar 2002 09:57
> > >An: NT Developers Interest List
> > >Betreff: [ntdev] impersonating
> > >
> > >
> > >How can I know if a requesting thread is impersonating?
> > >
> > >Alexey Logachyov
> > >xxxxx@vba.com.by
> > >VirusBlokAda ltd.
> > >http://www.vba.com.by
> > >
> > >
> > >
> > >—
> > >You are currently subscribed to ntdev as: xxxxx@david-gmbh.de
> > >To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

Dear all,
I need set up the environment to build Device driver
for windows 2000, but I have only the Retail build of
windows 2000. Where I can get checked build of Windows
2000?
Thanks for your help
Nguyễn Hoàng Việt

Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

Hello Viet,

Viet Nguyen wrote on Friday, February 8, 2002:
VN> I need set up the environment to build Device driver for windows
VN> 2000, but I have only the Retail build of windows 2000. Where I
VN> can get checked build of Windows 2000?
two places:
– msdn subscription (cds)
– msdn web site (if you are a subscriber)

Best regards,

Oleg Smolsky
Senior Software Engineer
Allied Telesyn Research

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

How do I open impersonation token?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim
S. Shatskih
Sent: Thursday, February 07, 2002 8:41 PM
To: NT Developers Interest List
Subject: [ntdev] Re: AW: impersonating

Thread has both primary token and impersonation token.
Thread is impersonating if its impersonation token is not NULL.
Primary token is always nonNULL - this is the process’s token.

Max

----- Original Message -----
From: “Alexey Logachyov”
> To: “NT Developers Interest List”
> Sent: Thursday, February 07, 2002 4:18 PM
> Subject: [ntdev] Re: AW: impersonating
>
>
> > I mean when I have token opened how can I know if thread is
> impersonating?
> >
> > Alexey Logachyov
> > xxxxx@vba.com.by
> > VirusBlokAda ltd.
> > http://www.vba.com.by
> >
> > ----- Original Message -----
> > From: “Holger Thiele”
> > To: “NT Developers Interest List”
> > Sent: Thursday, February 07, 2002 12:37 PM
> > Subject: [ntdev] AW: impersonating
> >
> >
> > > You mean other than the undoc’ed NtOpenThreadToken?
> > >
> > > cheers,
> > >
> > > Holger Thiele
> > > D.A.V.I.D. GmbH
> > > xxxxx@david-gmbh.de
> > >
> > >
> > > >-----Ursprungliche Nachricht-----
> > > >Von: Alexey Logachyov [mailto:xxxxx@vba.com.by]
> > > >Gesendet: Donnerstag, 7. Februar 2002 09:57
> > > >An: NT Developers Interest List
> > > >Betreff: [ntdev] impersonating
> > > >
> > > >
> > > >How can I know if a requesting thread is impersonating?
> > > >
> > > >Alexey Logachyov
> > > >xxxxx@vba.com.by
> > > >VirusBlokAda ltd.
> > > >http://www.vba.com.by
> > > >
> > > >
> > > >
> > > >—
> > > >You are currently subscribed to ntdev as: xxxxx@david-gmbh.de
> > > >To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com