'Determine file owner from a Windows kernel-mode driver
Using C in a Windows in a Kernel Mode Driver using KMDF, how do I determine the owner a of file?
I searched high and low but could not find any hint. Only C++ and of course Csharp.
Solution 1:[1]
After opening a handle to a file, you can use the kernel-mode ZwQuerySecurityObject to get the owner information (and full DACL).
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | nobody |