Find thread and token accessing file via shre on the server

Hi all, i’m new to debugging and I need some help with learning )
Actually at the moment i’m trying to find the server side thread, I assume it should be a kernel thread, and the identity (token) which appear on the server when accessed by client trying to open file via hidden or public share. So to be clear, when client tries to open file the server via hidden or public share some “thread” running on server does the actual job, I believe. SO i’d like to find a way to find this thread and associated user identity (token)

Thanks in advance.
Andrew

It will be some srv/srv2 thread that will satisfy the request. You can
apply a breakpoint on srv/srv2!srvcreatefile. Doing a !thread on that
thread will show you the impersonation token as well.

Thanks

On Fri, May 22, 2015 at 4:48 PM, wrote:

> Hi all, i’m new to debugging and I need some help with learning )
> Actually at the moment i’m trying to find the server side thread, I assume
> it should be a kernel thread, and the identity (token) which appear on the
> server when accessed by client trying to open file via hidden or public
> share. So to be clear, when client tries to open file the server via hidden
> or public share some “thread” running on server does the actual job, I
> believe. SO i’d like to find a way to find this thread and associated user
> identity (token)
>
> Thanks in advance.
> Andrew
>
> —
> WINDBG is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>