IRP_MJ_CREATE (New Files and Folders)

NTFSD
1

Hi All,

  1. How can I now that a new file is being created?

My assumption is that in IrpSp->Parameters.Create.Options high 8
bits are for Disposition. So if this value is any of the following

FILE_SUPERSEDE

FILE_CREATE

FILE_OPEN_IF

FILE_OVERWRITE

FILE_OVERWRITE_IF

then a new file is created.

  1. If my assumtion is currect then will that be same when a folder is
    created.

My goal is

to deny creation of new files and folders in a pre defined folder.

to deny deletion of existing files and folders in a pre defined folder.

regards

VC

2

Vishnu P

Can you use windows builtin security to realise your goal? Why not?

Cheers
Lyndon

“vishnu P” wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> 1. How can I now that a new file is being created?
>
> My assumption is that in IrpSp->Parameters.Create.Options high 8
> bits are for Disposition. So if this value is any of the following
>
> FILE_SUPERSEDE
>
> FILE_CREATE
>
> FILE_OPEN_IF
>
> FILE_OVERWRITE
>
> FILE_OVERWRITE_IF
>
> then a new file is created.
>
> 2. If my assumtion is currect then will that be same when a folder is
> created.
>
>
>
> My goal is
>
> to deny creation of new files and folders in a pre defined folder.
>
> to deny deletion of existing files and folders in a pre defined folder.
>
>
>
> regards
>
> VC
>
>
>
>