Distinguish the SMB connection per Windows Terminal Session.

NTFSD
1

Hi,

I want to some how distinguish the SMB connection per Windows Terminal Session.

IoGetRequestorSessionId() takes IRP as input parameter and returns the Requesters Session Id as output parameter. However the SMB request gets transformed to network request at TDI or NDIS level. Therefore I can not use this API at that level.

I have no knowledge of Filesystem driver. However I believe that filesystem transform the SMB request from a IO request to a network request. I was wondering if there is a way in filesystem drivers (amy be some kind of filter driver) to track this SMB request and use IoGetRequestorSessionId() API to figure out the source WTS session?

Any help, suggestion will be much appreciated!

Thanks,
Nilesh Samant.

2

I’m not sure what you are trying to do. Are you ON a terminal server system and you want to know from which session the operations started? If so, grab the session ID during the IRP_MJ_CREATE processing (“pre create” in a mini-filter) and store that in your stream handle context. That’s about as good as you can do (theoretically, if the handle is duplicated it COULD be used from a different session, but that’s not common, certainly.)

Presumably, this will work for other I/O operations that originate with user mode components as well.

Or are you trying to do this from the file server side? If so, you can’t get that information - it was stripped out long ago.

Tony
OSR

3

Hi Tony,

Thanks for reply. I want to do it on WTS system.

I am trying to use IoGetRequestorSessionId() at TDI filter driver. Is that what you mean by mini-filter?

Regards,
Nilesh Samant