Information from client in server based filter

NTFSD
1

Can anyone help with these questions:

  1. Can the SID of the user initiating each type of file request on the
    client be correctly obtained in the file system filter driver on the
    server?

  2. On the server can this SID then be used (in user mode) to obtain the
    Active Directory User Name?

  3. Can the hostname of the workstation initiating each type of file
    request on the client be correctly obtained in the file system filter
    driver on the server?

  4. In a client based filter driver, is the PID of the the application
    that originated the file request to the server available in the Post
    Operation for IRP_MJ_CREATE?

Thanks

Jonathan Oliver
WinST Product Development Lead
BAE Systems Integrated System Technologies (Insyte)
01202 40-4030

Sent by BAE Systems plc or a member of the BAE Systems group of
companies

BAE Systems plc
A company registered in England and Wales Company Number 1470151
Registered Office: 6 Carlton Gardens, London SW1Y 5AD, United Kingdom

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

2

>1. Can the SID of the user initiating each type of file request on the

client be correctly obtained in the file system filter driver on the
server?

Yes, trivially.

  1. On the server can this SID then be used (in user mode) to obtain the
    Active Directory User Name?

Yes, proxy the SID to user mode and call LookupAccountSid there. I think that
newer Windows have exactly this function in the kernel, maybe undocumented.

  1. Can the hostname of the workstation initiating each type of file
    request on the client be correctly obtained in the file system filter
    driver on the server?

SeQueryInformationToken or LsaCallAuthenticationPackage with some undocumented
info class. I believe that the client machine name is kept somewhere in LSA.

This is not supported and undocumented.

  1. In a client based filter driver, is the PID of the the application
    that originated the file request to the server available in the Post
    Operation for IRP_MJ_CREATE?

Impossible. Just plain impossible, at least for SMB/CIFS - it does not send
this information over the network.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com