I do a test for SeMarkLogonSessionForTerminationNotification.
1.in driverentry,I SeRegisterLogonSessionTerminatedRoutine,it return success.
2.I use logonsessions from sysinternals to list my login session.
3.my application call my driver to mark a specific session.
SeMarkLogonSessionForTerminationNotification return success.
I logoff,but my callback never been called.
And,when I log in again,I use logonsessions to list all sessions.
Crazy!the session I marked is still exist!!!
(I log in 10 times,and log off 10 times.the sessions I don’t marked will disappear!But the session I marked will be exist always!)
the session is a GUI interactive login.
anybody can clear it?
SeMarkLogonSessionForTerminationNotification, as the name implies, registers a callout to be invoked when the logon session goes away; it doesn’t delete the logon session then and there. Logon sessions are conceptually reference counted.
If you read the documentation, you’ll note the following:
“A logon session terminates when the last token referencing the logon is deleted.”
Notice that there’s no mention of “logging off”. Just because you log out of the winstation doesn’t mean that there are not still tokens (or references to tokens) with that logon session’s AuthenticationId still hanging about.
Or, to reinforce the point more directly: “Logging off” via winlogon != deleting a logon session outright.
-----Original Message-----
From: xxxxx@hotmail.com
Sent: Saturday, February 28, 2009 09:52
To: Windows File Systems Devs Interest List
Subject: [ntfsd] SeMarkLogonSessionForTerminationNotification can’t work!
I do a test for SeMarkLogonSessionForTerminationNotification.
1.in driverentry,I SeRegisterLogonSessionTerminatedRoutine,it return success.
2.I use logonsessions from sysinternals to list my login session.
3.my application call my driver to mark a specific session.
SeMarkLogonSessionForTerminationNotification return success.
-----------------------
I logoff,but my callback never been called.
And,when I log in again,I use logonsessions to list all sessions.
Crazy!the session I marked is still exist!!!
(I log in 10 times,and log off 10 times.the sessions I don’t marked will disappear!But the session I marked will be exist always!)
----------------------
the session is a GUI interactive login.
anybody can clear it?
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Yes,I know it.
When log off from winlogon != deleteing the logon session.
But,in my test:
If I don’t call SeMarkLogonSessionForTerminationNotification for a specific loginID,then the loginID will be deleted when I log off and log in again.
that’s to say:
when I log off and then log in again,I execute logonsessions,the specific loginID will disappeared!
But I call SeMarkLogonSessionForTerminationNotification for a specific loginID,even it I log off and log in again,the specific loginID still exist.
I repeat log off and log in again about 10 times,the specific loginID still exist in logonsessions.exe output!
So,it’s very crazy.
Hi Clark,
Its hard to tell until u give us an idea of the code that you have written in it; but i would guess that you have put a reference on something that is preventing the session from getting deleted. And this guess is based on your sentence “But I call SeMarkLogonSessionForTerminationNotification for a specific loginID,even it I log off and log in again,the specific loginID still exist.”
Regards,
Ayush Gupta
http://windows-internals.blogspot.com/
Download prohibited? No problem. CHAT from any browser, without download. Go to http://in.webmessenger.yahoo.com/
> And this guess is based on your sentence "But I
call SeMarkLogonSessionForTerminationNotification for a specific loginID
… or, in other words, is it possible that while getting this loginID you
open a session and do not close it?
Then, as was mentioned [by Joe?] before, the refcount on the session
object remains non-zero even if you close the session per se.
----- Original Message -----
From: “Ayush Gupta”
To: “Windows File Systems Devs Interest List”
Sent: Sunday, March 1, 2009 12:39:48 AM GMT -05:00 US/Canada Eastern
Subject: RE:[ntfsd] SeMarkLogonSessionForTerminationNotification can’t work!
Hi Clark,
Its hard to tell until u give us an idea of the code that you have written in it; but i would guess that you have put a reference on something that is preventing the session from getting deleted. And this guess is based on your sentence “But I call SeMarkLogonSessionForTerminationNotification for a specific loginID,even it I log off and log in again,the specific loginID still exist.”
Regards,
Ayush Gupta
http://windows-internals.blogspot.com/
Download prohibited? No problem. CHAT from any browser, without download. Go to http://in.webmessenger.yahoo.com/
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Hi!
Then, as was mentioned [by Joe?] before, the refcount on
the session
object remains non-zero even if you close the session per
se.
Ya… But my point was that may be the OP has done something that has increased the reference count.
Regards,
Ayush Gupta
http://windows-internals.blogspot.com/
Bollywood news, movie reviews, film trailers and more! Go to http://in.movies.yahoo.com/
>Ya… But my point was that may be the OP has done
something that has increased the reference count.
… my point being that [s]he should have found it
by now 
----- Original Message -----
From: “Ayush Gupta”
To: “Windows File Systems Devs Interest List”
Sent: Sunday, March 1, 2009 8:42:46 AM GMT -05:00 US/Canada Eastern
Subject: Re: [ntfsd] SeMarkLogonSessionForTerminationNotification can’t work!
Hi!
>
> Then, as was mentioned [by Joe?] before, the refcount on
> the session
> object remains non-zero even if you close the session per
> se.
>
Ya… But my point was that may be the OP has done something that has increased the reference count.
Regards,
Ayush Gupta
http://windows-internals.blogspot.com/
Bollywood news, movie reviews, film trailers and more! Go to http://in.movies.yahoo.com/
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
I think I have described how can I get the loginID.
>>2.I use logonsessions from sysinternals to list my login session.
>>3.my application call my driver to mark a specific session.
Yes,I just execute logonsessions.exe,and get the loginID by my eyes^_^.
If I pass the loginID to my driver(I have a GUI app,pass the loginID to my driver by DIOC).
My driver just call SeMarkLogonSessionForTerminationNotification.
So,I think I don’t refer the session.
If I don’t mark the loginID,when I logoff and login again,I execute the logonsessions,the session is disappeared.
But I do mark the loginID,when I logoff and login again,I execute the logonsessions,the session still exist!