Fwd: Access Based enumeration (ABE) in windows

NTFSD
1

Any comments on this..

Hi,
Is ABE functionality implemented with the help of filter driver or NTFS
filters the directory enumeration based on user permission. I could not find
any link on how it is implemented internally.

Thanks
Ash

2

If I am correct, you mean listing of directory entries and skipping the ones
that the user does not have access to?

If yes, then it is done in NTFS itself; no filter driver for that.

Regards,

Ayush Gupta

AI Consulting

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ashish Goyal
Sent: Friday, April 02, 2010 11:45 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Fwd: Access Based enumeration (ABE) in windows

Any comments on this..

Hi,

Is ABE functionality implemented with the help of filter driver or NTFS
filters the directory enumeration based on user permission. I could not find
any link on how it is implemented internally.

Thanks

Ash

--- NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars (including our new fs mini-filter seminar) visit:
OSR Seminars – OSR To unsubscribe, visit the List Server section of
OSR Online at ListServer/Forum

3

Thanks Ayush…Thanks for confirming

On Fri, Apr 2, 2010 at 11:50 AM, Ayush Gupta wrote:

> If I am correct, you mean listing of directory entries and skipping the
> ones that the user does not have access to?
>
> If yes, then it is done in NTFS itself; no filter driver for that.
>
>
>
> Regards,
>
> Ayush Gupta
>
> AI Consulting
>
>
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *Ashish Goyal
> Sent: Friday, April 02, 2010 11:45 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Fwd: Access Based enumeration (ABE) in windows
>
>
>
> Any comments on this…
> ---------------------
>
>
> Hi,
>
> Is ABE functionality implemented with the help of filter driver or NTFS
> filters the directory enumeration based on user permission. I could not find
> any link on how it is implemented internally.
>
>
>
> Thanks
>
> Ash
>
>
> — NTFSD is sponsored by OSR For our schedule of debugging and file system
> seminars (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars To unsubscribe, visit the List Server section
> of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

4

I’m not sure I understand this now :wink:
Do you mean NTFS hides some files during listing? I have never seen
that. Any file is listed including those the user cannot access. (you
cannot list a directory that you are denied access to, but that does not
mean NTFS would skip listing its name)

Or did I completely misunderstand?

Ashish Goyal wrote:

Thanks Ayush…Thanks for confirming

On Fri, Apr 2, 2010 at 11:50 AM, Ayush Gupta
> wrote:
>
> > If I am correct, you mean listing of directory entries and skipping
> the
> > ones that the user does not have access to?
> >
> > If yes, then it is done in NTFS itself; no filter driver for that.

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

5

Oops! Usage of wrong words. :wink:

Regards,
Ayush Gupta
AI Consulting

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Friday, April 02, 2010 6:29 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Access Based enumeration (ABE) in windows

I’m not sure I understand this now :wink:
Do you mean NTFS hides some files during listing? I have never seen
that. Any file is listed including those the user cannot access. (you
cannot list a directory that you are denied access to, but that does not
mean NTFS would skip listing its name)

Or did I completely misunderstand?

Ashish Goyal wrote:

Thanks Ayush…Thanks for confirming

On Fri, Apr 2, 2010 at 11:50 AM, Ayush Gupta
> wrote:
>
> > If I am correct, you mean listing of directory entries and skipping
> the
> > ones that the user does not have access to?
> >
> > If yes, then it is done in NTFS itself; no filter driver for that.

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

—
NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

Guys, Access Based Enumeration refers to a feature where a user can see only the files he has access to. (So, Ayush is correct in his initial reply.)
Refer to the link below for more details:
http://technet.microsoft.com/en-us/library/cc784710(WS.10).aspx

Per my *limited* knowledge, this feature is applicable only to Shares hosted on Servers.
Thus, seems like it is more relevant to srv.sys and not the NTFS driver.
However, you should confirm it yourself.
I had suggest using Procmon to understand the implementation.

7

You could confirm it yourself by sharing a FAT folder and see what happens.

Personally, I have no idea.

mm