am working on minifilter based on shadow file. i am attached on MUP, i deleted an executable file on remote FS then copied same file again i am getting DELETE_PENDING on that till the system restart. When i give DELETE flag in Desired Acess it works fine . Can anyone through some light on this behaviour.
The first thing to establish is where the delete pending is coming from. Is
it from RDR? from MUP? from SRV? from the remote FSD? from your code?
Armed with that you should be able to work out what is happening and why.
If I *had* to guess I would suggest that someone is forgetting to flush a
cache and a file object is still pinning the file somewhere.
Thanks Rod for your Prompt reply…some more info on this issue
This problem appears to be similar to the discussion http://www.osronline.com/showThread.cfm?link=127046
Our driver is a minifilter based on interface FltXXXX calls, that attaches to \Device\MUP.
It doesn?t interact directly with redirectors .
In our scenario Ref count is maintained in FCB and when FCB->ref == 1 , In Cleanup calls we are call MmForceSectionClosed & MmFlushImageSection
But in case of Remote FS it returns FALSE i.e. FAILED.
This means that MM has not purged the section objects, Hence the close is not received.
How to make sure it returns TRUE or what to wait?