EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Can the Callbackfilter run on Terminal Services Architecture?

Also by EldoS: CallbackRegistry
A component to monitor and control Windows registry access and create virtual registry keys.
#30152
Posted: 07/24/2014 22:00:54
by james ju (Standard support level)
Joined: 11/24/2013
Posts: 4

Can the Callbackfilter run on Terminal Services Architecture?


#30155
Posted: 07/25/2014 01:48:30
by Eugene Mayevski (EldoS Corp.)

The picture itself doesn't have relation to CalbackFilter. Please explain what you want to accomplish, i.e. where the files are located and where you want to track the changes.


Sincerely yours
Eugene Mayevski
#30156
Posted: 07/25/2014 02:12:21
by james ju (Standard support level)
Joined: 11/24/2013
Posts: 4

In a Terminal Services (multi-user) environment inside, when one of the Session set the ProcessRequest property to false, the Session will affect other users, leading to other Session of users can not open any files until other users are logged off, it is working properly.

Callbackfilter is an application running in the System Space in it?

http://technet.microsoft.com/en-us/library/cc755399(v=ws.10).aspx
#30157
Posted: 07/25/2014 02:33:34
by Eugene Mayevski (EldoS Corp.)

Thank you for explanation. CallbackFilter core works in kernel-mode which doesn't know about sessions. While the user-mode part indeed calls your code in user mode, the actions are global.

Potentially you can use GetOriginator*() methods of CallbackFilter to get to know, what or who requested the operation, and block the operation conditionally. But this will work mainly for file opening requests. For directory enumeration this will not work because the OS caches directory listings globally.


Sincerely yours
Eugene Mayevski

Reply

Statistics

Topic viewed 2552 times

Number of guests: 2, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!