Logoff callback using SeRegisterLogonSessionTerminatedRoutine not always called ?

NTFSD
1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Heya guys … i’ve a weird problem in my fs filter, and as far as i see from
browsing thru posts, seems its a known problem.

I need to know when a user log off, so i have :

  1. in DriverEntry :

SeRegisterLogonSessionTerminatedRoutine((PSE_LOGON_SESSION_TERMINATED_ROUTIN
E) LogoffCallback);

  1. in FsCreateDispatch on each IRP_MJ_CREATE_IRP i receive i grab the LUID
    of the currently logged user:

SeQueryAuthenticationIdToken
(IrpSp->Parameters.Create.SecurityContext->AccessState->SubjectSecurityConte
xt.PrimaryToken,
&LogonId);
SeMarkLogonSessionForTerminationNotification(&LogonId);

  1. in my shutdown callback i deregister the LogoffCallback routine

What happens is that i’m not called at each logoff, but only sometimes. Its
very weird, but its exactly what happened to another guy who posted here.
Still, reading his thread
(http://www.osronline.com/lists_archive/ntfsd/thread2927.html) i haven’t
been able to find a solution.
Btw, the OS is xp sp1.

Any clue ?

Regards,
Valerio
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBQEOqkmGxr2U3nc5EEQIHeACg4HTcHmaDJgAJn+TPmQGEWycHuc8AnjH7
oGZlPKh/L7Xrr0Sg739uH7dT
=Z+k6
-----END PGP SIGNATURE-----

2

> 3) in my shutdown callback i deregister the LogoffCallback routine

For what? No need in this.

What happens is that i’m not called at each logoff, but only sometimes.

Must be called at each logoff. The last time I checked this (in NT4) it was
really so.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com