RDP Clipboard redirection monitoring

NTFSD
1

Hi,

I have a mini filter driver which monitors any File copy-paste operation.
When user connects with some Remote machine using mstsc and shared his local resources (drive, clipborad etc.). In Win XP my filter driver monitor File Copy-paste activity between local and Remote desktop. But for Win 7 I am not able to detect File copy-paste operation between RDP machine and my local machine. My filter driver is installed on remote machine.
I know that Win 7 is using RDP7.0 version which have the capability of redirecting the Clipboard data without Drive redirection also. Here I want to know I clip board redirection iworks ? Does it use RdpDr.sys for data sharing or it uses any other underline driver?
How can I make my filter driver to monitor File copy-paste operation?

Any help is really appreciated.

Thanks in advance
Bishnu

2

Hello,

I found that Clip board file copy-paste operation uses something called “Clipboard Virtual Channel Extension” to transfer file between RDP client and server. I also get to know that this mechanism use “Clipboard Virtual Channel” to transfer the data between two machines.
I want to know what is the “Clipboard Virtual Channel”?
Can I see this data transfer in my mini filter driver?

Thanks,
Bishnu