Mini filter driver can not detect Citrix network map drive

NTFSD
1

Hi all,

I have a mini filter driver that runs on Win Server 2008 to detect specified PreCreate operations.
It works well for local volumes.
However, it can not detect Citrix network map drive because it seems Citrix doesn’t register its network map drives into \device\mup.
ProcMon doesn’t work for these map drives as well, even I set its altitude to 390000 that is higher than Citrix legacy filter driver.

I guess it might be caused by Citrix file system filter driver that isolates all mini filter driver.

Is there any one could give me any hints or suggestions to make my mini filter driver work with Citrix network map drives?
Thanks a lot.

2

Not all third party redirector works with FltMgr, I had issues with VMWare HGFS; but its latest version supports minifilters.

Does filespy work with it? What all volumes it shows you to attach?

You should see something other than \device\MUP or other standard network device.(From my experience with HGFS). For example it creates \device\HGFS

Also check with FileSpy is there any differene if you launch it with legacy driver instead of minifilter.

3

Thanks.

FileSpy doesn’t work with Citrix network map drives.
There was no difference after I launched legacy driver instead of mini filter.

I found below volumes:
\device\harddiskvolume1
\device\mup
\device\rdpdr

I guess Citrix doesn’t register its network map drives into \device\mup, right?
How can I achieve that manually?

4

What device object does the drive letter symbolic link map to? You can find
this out via the debugger or ObjDir:

http://www.osronline.com/article.cfm?article=42

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

wrote in message news:xxxxx@ntfsd…

Thanks.

FileSpy doesn’t work with Citrix network map drives.
There was no difference after I launched legacy driver instead of mini
filter.

I found below volumes:
\device\harddiskvolume1
\device\mup
\device\rdpdr

I guess Citrix doesn’t register its network map drives into \device\mup,
right?
How can I achieve that manually?

5

Citrix map network drive to V:, but I can’t find this drive letter V: in the Global?? tree of ObjDir.
(I can find C: has a symbolic link to \device\harddiskvolume1 in the Global?? tree of ObjDir.)

I also find some Object names that have a prefix of Ctx.
I am not sure if it has something to do with Citrix network map drive.
CTXCDF symboliclink \device\CTXCDF
CTXSMCDRV symboliclink \device\CTXSMCDRV
CtxAltStr symboliclink \FileSystem\Filters\CtxAltStr
CtxRMPN symboliclink \Device\CitrixProcessMonitor0

Where should this drive letter appear in ObjDir?

Thanks.

6

btw, what can I do if I could get this Device Object name?

7

>>Citrix map network drive to V:, but I can’t find this drive letter V: in the
Global?? tree of ObjDir.

What happens when you do a createfile call on some file in V:? you can debug it to see where exactly IO Mgr is routing it.(To which DevObj)

IO Mgr needs the symbolic name in the objmgr dir before routing it to some device stack so it has to be there. Unless some layer above IO Mgr is changing V: to something which is meaningful for IO Mgr.

8

>Citrix map network drive to V:, but I can’t find this drive letter V: in

the Global?? tree of ObjDir.

Right, mapped drive letters are typically session specific, so you’ll find
them somewhere under \Sessions.

btw, what can I do if I could get this Device Object name?

You’ll know where the I/Os are being routed to and therefore know which
device it is you need to filter to see these operations.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

wrote in message news:xxxxx@ntfsd…

Citrix map network drive to V:, but I can’t find this drive letter V: in the
Global?? tree of ObjDir.
(I can find C: has a symbolic link to \device\harddiskvolume1 in the
Global?? tree of ObjDir.)

I also find some Object names that have a prefix of Ctx.
I am not sure if it has something to do with Citrix network map drive.
CTXCDF symboliclink \device\CTXCDF
CTXSMCDRV symboliclink \device\CTXSMCDRV
CtxAltStr symboliclink
\FileSystem\Filters\CtxAltStr
CtxRMPN symboliclink \Device\CitrixProcessMonitor0

Where should this drive letter appear in ObjDir?

Thanks.

9

Thank you very much.
It’s really helpful, I think I have got what I need now.