What happens when I access a file on server from a client?

NTFSD
1

When a user accesses a file on the server from the client, what happens?

The filter on the client receives the callback, but does the filter on
the server also receive it?

Is this the correct order of events?

  1. Client accesses file on server
  2. SMB/Network Redirector calls across to the server to retrieve the
    information for the file
  3. Filter on server is called
  4. File information sent back to client
  5. Filter on client is called.

Assuming the filter on the server is notified, can I determine there the
originating node name, user Id, process id of the client who requested
the file?

I have a client/server setup with XP on the client and Server 2003 R2 on
the server.
The client has a mapped drive to a share on the server.

My file system filter driver is installed on the client and server and
registers with FltMgr for the required callbacks.

Thanks for any information you can give me on this.

Jonathan Oliver
WinST
BAE Systems Insyte
01202 40-4030

Sent by BAE Systems plc or a member of the BAE Systems group of
companies

BAE Systems plc
A company registered in England and Wales Company Number 1470151
Registered Office: 6 Carlton Gardens, London SW1Y 5AD, United Kingdom

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

2

Oliver, Jonathan (UK) wrote:

Assuming the filter on the server is notified, can I determine there the
originating node name, user Id, process id of the client who requested
the file?

You can’t… that information isn’t available to filter drivers. User ID
may be possible (although the user may be logged onto the share under a
different username, or ‘guest’ so it’s not the client username).

Tony

3

>Assuming the filter on the server is notified, can I determine there the

originating node name, user Id, process id of the client who requested

Process ID is impossible. SMB protocol does not transfer it over the wire.

Node name is maybe possible, but will require digging into the undocumented
stuff in SRV or in Se Rm (the access token created by SRV has the associated
node name with it).

User SID - yes, as usually, using the usual way thru
Parameters->Create.SecurityContext.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com