Usage of SeMarkLogonSessionForTerminationNotification?

I’m having trouble using the:

SeMarkLogonSessionForTerminationNotification()
SeRegisterLogonSessionTerminatedRoutine()
SeUnregisterLogonSessionTerminatedRoutine()

routines in my (filter) file system driver. I am trying to use them to
clean up some structures that I allocate when a user logs in. However,
I don’t always seem to get the callback when the user logs out. I have
not found any examples of the correct usage of these routines in the IFS
kit or on the web (and the documentation is not crystal clear ;-), so
I’m hoping somebody can point me to an example. For instance, do you
call the Register entry in your file system init code, call the
Unregister entry in your file system cleanup code, and call the Mark
entry each time you get called (by a logged in user) to allocate the
structures that need to be cleaned up when the user logs out? Or, do
you do something like Mark and Register for each login session that
calls the file system and then Unregister as part of the logout cleanup?

Thanks for any help…

– Rick

> call the Register entry in your file system init code,

Yes.

Unregister entry in your file system cleanup code,

Yes.

and call the Mark entry each time you get called (by a logged in
user) to allocate the
structures that need to be cleaned up when the user logs out?

Yes. Mark is per-logon-session, and must be called on each logon
session which is “interesting” and you need a termination callback for
it. Without Mark, no logon session callbacks will occur, Register is
not enough.

Max