How to get sid when remote computer delete the files.

NTFSD
1

when a remote computer delete my shared file over LAN,I can not get the
impersonation token in the set-information
dispatch routine. i can only get primary token.How to know who is deleting
my files?

Regards,
ming

–
No one knows what tomorrow would be,
but I’ll do my best.

2

Store this information when you receive the IRP_MJ_CREATE. SRV does not
impersonate when sending the IRP_MJ_SET_INFORMATION in this case. So,
if the caller asks for DELETE access (or specified FILE_DELETE_ON_CLOSE,
as this will promote to DELETE access inside the FSD) in IRP_MJ_CREATE,
capture the SID.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the Next OSR File Systems Class October
18, 2004 in Silicon Valley!

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ming
Sent: Thursday, August 19, 2004 11:00 AM
To: ntfsd redirect
Subject: [ntfsd] How to get sid when remote computer delete the files.

when a remote computer delete my shared file over LAN,I can not get the
impersonation token in the set-information
dispatch routine. i can only get primary token.How to know who is
deleting
my files?

Regards,
ming

–
No one knows what tomorrow would be,
but I’ll do my best.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com