Get a handle to NTUSER.DAT?

NTFSD
1

Hello everyone, i am trying to get a handle to NTUSER.DAT in my kernel driver, im currently using IoCreateFile, but it fails for NTUSER.DAT and system32\config.…, as of my knowledge because the System process has open handles to these files.

I would like to know if there still is a way to get a handle to these files in a different way.

2

How does it ‘fail’? The error status will tell you where to go next.

3

@rod_widdowson said:
How does it ‘fail’? The error status will tell you where to go next.

Edit: it actually didnt fail at opening the file, i somehow got that wrong i have no idea how. it failed because of something else