Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Obtain user information from kernel mode.

31 views
Skip to first unread message

ken

unread,
Aug 7, 2008, 8:56:00 AM8/7/08
to
I am trying to obtain the current user login name and write it to a file.
Does anyone know what to use to get the user login name and how to change the
format so i can write it to a file?

Don Burn

unread,
Aug 7, 2008, 9:00:33 AM8/7/08
to
You can get the SID but I do not believe you can get the user name from the
kernel. Get the SID then hand it off to a user mode service to convert and
write.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

"ken" <k...@discussions.microsoft.com> wrote in message
news:435AE65A-443B-4178...@microsoft.com...

ken

unread,
Aug 7, 2008, 9:35:27 AM8/7/08
to
what do you use to get the sid?

Don Burn

unread,
Aug 7, 2008, 9:44:22 AM8/7/08
to
Use ZwOpenProcessToken then ZwQueryInformationToken to get the information.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

"ken" <k...@discussions.microsoft.com> wrote in message

news:4EC94C58-4098-47A4...@microsoft.com...

Maxim S. Shatskih

unread,
Aug 10, 2008, 2:09:15 PM8/10/08
to
> Use ZwOpenProcessToken then ZwQueryInformationToken to get the
>information.

Or, in MJ_CREATE path, use ->Parameters.Create.SecurityContext

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
ma...@storagecraft.com
http://www.storagecraft.com

Maxim S. Shatskih

unread,
Aug 10, 2008, 2:07:48 PM8/10/08
to
> I am trying to obtain the current user login name and write it to a file.

Use SIDs instead.

Resolving SID to name for the domain environment requires RPC query to the
domain controller, which is too hard to do in kernel mode.

allenzhang

unread,
Aug 10, 2008, 9:47:01 PM8/10/08
to
You can get it by GINA and then send it to kernel driver


Best regards,
Allen

Maxim S. Shatskih

unread,
Aug 10, 2008, 10:32:37 PM8/10/08
to
I would only use usernames on the UI layer, not below the UI.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
ma...@storagecraft.com
http://www.storagecraft.com

"allenzhang" <allen...@discussions.microsoft.com> wrote in message
news:FEE4541C-607B-4F05...@microsoft.com...

Ray Trent

unread,
Aug 12, 2008, 2:46:14 PM8/12/08
to
I addition to all the good suggestions people have made, please remember
that there isn't "a" current user. Multiple users can be logged on
simultaneously through Terminal Services or Fast User Switching, for
example.

And as far as applications calling your driver are concerned, they can
also be "run as" a different user than is currently logged on, even
without user intervention (via Scheduled Tasks).


--
Ray

0 new messages