user name / access file

NTFSD
1

Hello,

How can I get user name of user that is accessing a certain file from my
file system filter driver?

Any hints/references/docs would be appreciated.

–
Regards,
Elias

2

Use:
SeQueryAuthenticationIdToken
GetSecurityUserInfo
// If successful:
LsaFreeReturnBuffer to free the returned buffer
These have to be called in IRP_MJ_CREATE and via worker thread!
Won’t work otherwise (on some systems at least, IIRC).

Regards, Dejan.

lallous wrote:

Hello,

How can I get user name of user that is accessing a certain file from my
file system filter driver?

Any hints/references/docs would be appreciated.

–
Regards,
Elias

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

3

You can only get the user’s SID, by token manipulations in CREATE path.

Mapping SID to username requires things like RPC calls to the domain
controller, and is better to be offloaded to user mode.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “lallous”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Monday, October 27, 2003 7:15 PM
Subject: [ntfsd] user name / access file

> Hello,
>
> How can I get user name of user that is accessing a certain file from my
> file system filter driver?
>
> Any hints/references/docs would be appreciated.
>
> –
> Regards,
> Elias
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com