2.3.16 FSCTL_FIND_FILES_BY_SID Reply
The FSCTL_FIND_FILES_BY_SID Reply message returns the results of the FSCTL_FIND_FILES_BY_SID Request (section 2.3.15) as an array of FILE_NAME_INFORMATION (section 2.1.7) data elements containing relative pathnames (section 2.1.5), one for each matching file or directory that is found, in no necessary order. All returned file names MUST be relative to the directory on which the FSCTL_FIND_FILES_BY_SID Request was issued. This returns as many FILE_NAME_INFORMATION data elements as will fit in the provided output buffer. The beginning of each FILE_NAME_INFORMATION data element MUST be aligned to an 8-byte boundary, as measured from the beginning of the buffer. The last FILE_NAME_INFORMATION structure returned MAY<25> contain trailing padding.
This message also returns a status code as specified in section 2.2. Upon success, the status code returned by the function that processes this FSCTL is STATUS_SUCCESS. The most common error codes are listed in the following table.
|
Status code |
Meaning |
|---|---|
|
STATUS_NO_QUOTAS_FOR_ACCOUNT 0x0000010D |
Quota tracking is not enabled; therefore, the file system does not keep a record of file owners. This is considered a success code. The reply MUST NOT contain any data elements. |
|
STATUS_INVALID_PARAMETER 0xC000000D |
The handle specified is not the handle to a directory. |
|
STATUS_ACCESS_DENIED 0xC0000022 |
Neither the SeManageVolumePrivilege nor the SeBackupPrivilege, as specified in [MS-LSAD] section 3.1.1.2.1, privilege is held. |
|
STATUS_BUFFER_TOO_SMALL 0xC0000023 |
The output buffer is not large enough to contain the FILE_NAME_INFORMATION structure (including any trailing padding) for the first matching file or directory. |
|
STATUS_INVALID_USER_BUFFER 0xC00000E8 |
The input buffer is less than the size of a long integer (4 bytes) plus the length of the SID provided, or the input or output buffer is not aligned to the native word size of the platform, or the size of the output buffer is less than the minimum size of a FILE_NAME_INFORMATION structure (8 bytes), or the restart value is greater than 1. |
When the status code is STATUS_SUCCESS, the responder MUST retain an implementation-dependent indication of where the directory processing ended, which is required to support a subsequent FSCTL_FIND_FILES_BY_SID Request with the Restart field set to 0x00000000. For an example of FSCTL_FIND_FILES_BY_SID restart handling, see [MS-FSA] section 2.1.5.10.8.