NT domain User

NTFSD
1

Hi,

Can anyone please let us know how to find the NT Domain UserName from the minifilter. I know there is a call (GetUserName) to get the NT username from the application. Is there is any call to get the username from the minifilter or any other way to achieve the same.

Thanks and Regards,
Srinivasa Raghavan.

2

In general, no. Use the SID.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@patni.com
Sent: Monday, December 18, 2006 12:42 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] NT domain User

Hi,

Can anyone please let us know how to find the NT Domain UserName from the
minifilter. I know there is a call (GetUserName) to get the NT username from
the application. Is there is any call to get the username from the
minifilter or any other way to achieve the same.

Thanks and Regards,
Srinivasa Raghavan.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

The function to look up a user account name has been around for quite
some time in kernel mode (I think it is in W2K, but it is certainly in
more recent versions.)

SecLookupAccountSid will, given an SID, convert it into the string
equivalent of the user’s account. This is convenient for debugging
purposes or for cross-domain account mapping (via name) but should never
be used for security checks, since it is the SID, not the account name,
that is definitive.

Note that this is actually implemented as a call to a user mode service.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

4

> > Can anyone please let us know how to find the NT Domain UserName from

the
minifilter. I know there is a call (GetUserName) to get the NT username from

This requires the RPC query to the domain controller and is hardly a
correct thing to do in FS filters.

Use SIDs in your kernel-mode software and even in the set of IOCTLs to
control it, and do LookupAccountSid only in the user-mode code, as close to the
UI as possible.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

5

FWIW, SecLookupAccountSid is not in Win2K, even with UR1 installed.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: Tuesday, December 19, 2006 3:55 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] NT domain User

The function to look up a user account name has been around for quite
some time in kernel mode (I think it is in W2K, but it is certainly in
more recent versions.)

SecLookupAccountSid will, given an SID, convert it into the string
equivalent of the user’s account. This is convenient for debugging
purposes or for cross-domain account mapping (via name) but should never
be used for security checks, since it is the SID, not the account name,
that is definitive.

Note that this is actually implemented as a call to a user mode service.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com