Hello,
I’ve encountered an issue with Windows Server 2012, and perhaps others have seen this or have some insight?
The short of it is, we have a mini-filter driver that monitors file accesses, changes, modifies etc., and this has been working great for years. One of the things we do is extract the username from IRP_MJ_CREATE callbacks to audit file access/changes by user. To do this, we use a technique very similar to that described in this thread from ages ago:
www.osronline.com/showThread.cfm?link=16006
So, along comes Windows 2012 (and Windows 8), which introduce a new filter driver called ‘npsvctrig.sys’ or ‘Named Pipe Service Trigger Provider’ for short at a very low altitude (46000).
With this driver loaded, the usernames for file accesses get muddled up most of the time, but not always.
If npsvctrig is unloaded -or- its altitude is made very high (above our driver), things start working correctly again.
My guess is that npsvctrig is pending some/most/all IOs or similar, and at least some of these are switching thread contexts to another operation before our driver is called, thus intermittently changing the SecurityContext pointer.
So, the questions are likely unsurprising:
Has anyone encountered this problem and/or is familiar with npsvctrig?
Is what I’ve described above a plausible explanation for the anomolous behaviour?
Is there a way to detect such a condition or other way 'round it without major driver rewrites and/or unloading npsvctrig or sending it to mount everest?
Many thanks in advance for any insights,
Peter