STATUS_FILE_FORCED_CLOSED on remote drive

NTFSD
1

My File System Filter Driver is getting the error
STATUS_FILE_FORCED_CLOSED (0xC00000B6L) on a passed-thru
IRP_MJ_SET_INFORMATION(FileDispositionInformation). It only occurs
sometimes, and only if the file is on a remote drive. The problem is:
the file does exist, it’s attributes are normal, and it was not opened
with FILE_DELETE_ON_CLOSE.

It does not occur on a local drive.

Any tips or observations would be appreciated.

2

> My File System Filter Driver is getting the error

STATUS_FILE_FORCED_CLOSED (0xC00000B6L) on a passed-thru
IRP_MJ_SET_INFORMATION(FileDispositionInformation). It only occurs
sometimes, and only if the file is on a remote drive. The problem is:

The file was administratively closed. The redirector’s FCB has no more a
valid SMB file handle. So, no SMBs can originate from this file.
net use drive: /delete causes this thing.

Max

3

For the edification of the group, I’ll tell you what I found out on this one:
It is not enough to check for

CurrentStackLocation->Parameters.Create.Options & FILE_DELETE_ON_CLOSE

You must also check for:

CurrentStackLocation->Parameters.Create.SecurityContext->DesiredAccess &
DELETE

I.e., it is possible that the latter is set but the former is not.

Neil

PS, thanks to Jamey and Maxim for their help with this one.