Intellectual Property Rights Notice for Open Specifications Documentation s50

[MS-DLTW]:
Distributed Link Tracking:
Workstation Protocol

Intellectual Property Rights Notice for Open Specifications Documentation

§  Technical Documentation. Microsoft publishes Open Specifications documentation for protocols, file formats, languages, standards as well as overviews of the interaction among each of these technologies.

§  Copyrights. This documentation is covered by Microsoft copyrights. Regardless of any other terms that are contained in the terms of use for the Microsoft website that hosts this documentation, you may make copies of it in order to develop implementations of the technologies described in the Open Specifications and may distribute portions of it in your implementations using these technologies or your documentation as necessary to properly document the implementation. You may also distribute in your implementation, with or without modification, any schema, IDL’s, or code samples that are included in the documentation. This permission also applies to any documents that are referenced in the Open Specifications.

§  No Trade Secrets. Microsoft does not claim any trade secret rights in this documentation.

§  Patents. Microsoft has patents that may cover your implementations of the technologies described in the Open Specifications. Neither this notice nor Microsoft's delivery of the documentation grants any licenses under those or any other Microsoft patents. However, a given Open Specification may be covered by Microsoft Open Specification Promise or the Community Promise. If you would prefer a written license, or if the technologies described in the Open Specifications are not covered by the Open Specifications Promise or Community Promise, as applicable, patent licenses are available by contacting .

§  Trademarks. The names of companies and products contained in this documentation may be covered by trademarks or similar intellectual property rights. This notice does not grant any licenses under those rights. For a list of Microsoft trademarks, visit www.microsoft.com/trademarks.

§  Fictitious Names. The example companies, organizations, products, domain names, email addresses, logos, people, places, and events depicted in this documentation are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred.

Reservation of Rights. All other rights are reserved, and this notice does not grant any rights other than specifically described above, whether by implication, estoppel, or otherwise.

Tools. The Open Specifications do not require the use of Microsoft programming tools or programming environments in order for you to develop an implementation. If you have access to Microsoft programming tools and environments you are free to take advantage of them. Certain Open Specifications are intended for use in conjunction with publicly available standard specifications and network programming art, and assumes that the reader either is familiar with the aforementioned material or has immediate access to it.

Revision Summary

Date / Revision History / Revision Class / Comments /
03/02/2007 / 1.0 / Major / Updated and revised the technical content.
04/03/2007 / 1.1 / Minor / Updated the technical content.
05/11/2007 / 1.2 / Minor / Addressed EU feedback
06/01/2007 / 1.3 / Minor / Updated the technical content.
07/03/2007 / 2.0 / Major / Converted to unified format.
08/10/2007 / 3.0 / Major / Updated and revised the technical content.
09/28/2007 / 4.0 / Major / Updated and revised the technical content.
10/23/2007 / 4.1 / Minor / Updated the IDL.
01/25/2008 / 4.1.1 / Editorial / Revised and edited the technical content.
03/14/2008 / 4.1.2 / Editorial / Revised and edited the technical content.
06/20/2008 / 5.0 / Major / Updated and revised the technical content.
07/25/2008 / 6.0 / Major / Updated and revised the technical content.
08/29/2008 / 6.0.1 / Editorial / Revised and edited the technical content.
10/24/2008 / 6.0.2 / Editorial / Revised and edited the technical content.
12/05/2008 / 6.1 / Minor / Updated the technical content.
01/16/2009 / 6.1.1 / Editorial / Revised and edited the technical content.
02/27/2009 / 6.1.2 / Editorial / Revised and edited the technical content.
04/10/2009 / 6.1.3 / Editorial / Revised and edited the technical content.
05/22/2009 / 6.1.4 / Editorial / Revised and edited the technical content.
07/02/2009 / 6.2 / Minor / Updated the technical content.
08/14/2009 / 6.2.1 / Editorial / Revised and edited the technical content.
09/25/2009 / 7.0 / Major / Updated and revised the technical content.
11/06/2009 / 7.0.1 / Editorial / Revised and edited the technical content.
12/18/2009 / 8.0 / Major / Updated and revised the technical content.
01/29/2010 / 9.0 / Major / Updated and revised the technical content.
03/12/2010 / 9.0.1 / Editorial / Revised and edited the technical content.
04/23/2010 / 9.0.2 / Editorial / Revised and edited the technical content.
06/04/2010 / 9.0.3 / Editorial / Revised and edited the technical content.
07/16/2010 / 9.0.3 / No change / No changes to the meaning, language, or formatting of the technical content.
08/27/2010 / 10.0 / Major / Significantly changed the technical content.
10/08/2010 / 10.0 / No change / No changes to the meaning, language, or formatting of the technical content.
11/19/2010 / 10.0 / No change / No changes to the meaning, language, or formatting of the technical content.
01/07/2011 / 10.0 / No change / No changes to the meaning, language, or formatting of the technical content.
02/11/2011 / 10.0 / No change / No changes to the meaning, language, or formatting of the technical content.
03/25/2011 / 10.0 / No change / No changes to the meaning, language, or formatting of the technical content.
05/06/2011 / 10.0 / No change / No changes to the meaning, language, or formatting of the technical content.
06/17/2011 / 10.1 / Minor / Clarified the meaning of the technical content.
09/23/2011 / 10.1 / No change / No changes to the meaning, language, or formatting of the technical content.
12/16/2011 / 11.0 / Major / Significantly changed the technical content.
03/30/2012 / 11.0 / No change / No changes to the meaning, language, or formatting of the technical content.
07/12/2012 / 11.0 / No change / No changes to the meaning, language, or formatting of the technical content.
10/25/2012 / 11.0 / No change / No changes to the meaning, language, or formatting of the technical content.
01/31/2013 / 11.0 / No change / No changes to the meaning, language, or formatting of the technical content.
08/08/2013 / 12.0 / Major / Significantly changed the technical content.
11/14/2013 / 12.0 / No change / No changes to the meaning, language, or formatting of the technical content.

2/2

[MS-DLTW] — v20131025

Distributed Link Tracking: Workstation Protocol

Copyright © 2013 Microsoft Corporation.

Release: Friday, October 25, 2013

Contents

1 Introduction 6

1.1 Glossary 6

1.2 References 7

1.2.1 Normative References 7

1.2.2 Informative References 7

1.3 Overview 8

1.4 Relationship to Other Protocols 9

1.5 Prerequisites/Preconditions 9

1.6 Applicability Statement 9

1.7 Versioning and Capability Negotiation 10

1.8 Vendor-Extensible Fields 10

1.9 Standards Assignments 10

2 Messages 11

2.1 Transport 11

2.2 Common Data Types 11

2.2.1 HRESULT 11

2.2.2 CMachineId 11

2.2.3 CDomainRelativeObjId 12

2.2.4 CVolumeId 12

2.2.5 CObjId 12

3 Protocol Details 13

3.1 DLT Workstation Server Details 13

3.1.1 Abstract Data Model 13

3.1.2 Timers 13

3.1.3 Initialization 13

3.1.4 Message Processing Events and Sequencing Rules 13

3.1.4.1 Receiving a LnkSearchMachine Call (Opnum 12) 14

3.1.4.2 Receiving a FSCTL_LMR_SET_LINK_TRACKING_INFORMATION Request 17

3.1.5 Timer Events 17

3.1.6 Other Local Events 17

3.1.6.1 File Is Moved Between Volumes on Local Machine 18

3.1.6.2 File Is Moved from Local Machine to Remote Machine 19

3.1.6.3 File Is Moved from Remote Machine to Local Machine 19

3.1.6.4 File Is Moved by the Local Machine from Remote Machine to Remote Machine 20

3.2 DLT Workstation Client Details 21

3.2.1 Abstract Data Model 21

3.2.2 Timers 21

3.2.3 Initialization 22

3.2.4 Message Processing Events and Sequencing Rules 22

3.2.4.1 Completing a LnkSearchMachine Call 22

3.2.5 Timer Events 22

3.2.6 Other Local Events 22

4 Protocol Examples 24

4.1 LnkSearchMachine 24

4.2 FSCTLs 25

5 Security 27

5.1 Security Considerations for Implementers 27

5.2 Index of Security Parameters 27

6 Appendix A: Full IDL 28

7 Appendix B: Product Behavior 30

8 Change Tracking 35

9 Index 36

2/2

[MS-DLTW] — v20131025

Distributed Link Tracking: Workstation Protocol

Copyright © 2013 Microsoft Corporation.

Release: Friday, October 25, 2013

1 Introduction

This document specifies the Distributed Link Tracking: Workstation Protocol.

Distributed Link Tracking (DLT) consists of two protocols that work together to discover the new location of a file that has moved. DLT can determine if the file has moved on a mass-storage device, within a computer, or between computers in a network. The Distributed Link Tracking: Workstation Protocol helps a computer locate files that have been moved within a computer or between computers in a computer network.

In addition to the Distributed Link Tracking: Workstation Protocol, DLT includes the Distributed Link Tracking: Central Manager Protocol that keeps track of file and volume moves as well as other relevant information from participating computers so it can provide this information in response to workstation queries. Both DLT protocols are remote procedure call (RPC) interfaces.

Sections 1.8, 2, and 3 of this specification are normative and can contain the terms MAY, SHOULD, MUST, MUST NOT, and SHOULD NOT as defined in RFC 2119. Sections 1.5 and 1.9 are also normative but cannot contain those terms. All other sections and examples in this specification are informative.

1.1 Glossary

The following terms are defined in [MS-GLOS]:

Distributed Link Tracking (DLT)
dynamic endpoint
endpoint
Fid
FileLinkInformation
FileLocation
globally unique identifier (GUID)
Interface Definition Language (IDL)
MachineID
Microsoft Interface Definition Language (MIDL)
named pipe
NetBIOS Name
ObjectID
opnum
remote procedure call (RPC)
RPC protocol sequence
security provider
Server Message Block (SMB)
Universal Naming Convention (UNC)
universally unique identifier (UUID)
volume
VolumeID
well-known endpoint

The following terms are defined in [MS-DLTM]:

FileID

The following terms are specific to this document:

CrossVolumeMoveFlag: A value of either zero or one, stored as an attribute on a file, which is used to indicate whether the file has been moved across volumes at any time in the past.

workstation: A terminal or desktop computer in a network. In this context, workstation is just a generic term for a user's (client) machine, in contrast to a server.

MAY, SHOULD, MUST, SHOULD NOT, MUST NOT: These terms (in all caps) are used as described in [RFC2119]. All statements of optional behavior use either MAY, SHOULD, or SHOULD NOT.

1.2 References

References to Microsoft Open Specifications documentation do not include a publishing year because links are to the latest version of the documents, which are updated frequently. References to other documents include a publishing year when one is available.

A reference marked "(Archived)" means that the reference document was either retired and is no longer being maintained or was replaced with a new document that provides current implementation details. We archive our documents online [Windows Protocol].

1.2.1 Normative References

We conduct frequent surveys of the normative references to assure their continued availability. If you have any issue with finding a normative reference, please contact . We will assist you in finding the relevant information. Please check the archive site, http://msdn2.microsoft.com/en-us/library/E4BD6494-06AD-4aed-9823-445E921C9624, as an additional source.

[C706] The Open Group, "DCE 1.1: Remote Procedure Call", C706, August 1997, https://www2.opengroup.org/ogsys/catalog/c706

[MS-DTYP] Microsoft Corporation, "Windows Data Types".

[MS-ERREF] Microsoft Corporation, "Windows Error Codes".

[MS-FSCC] Microsoft Corporation, "File System Control Codes".

[MS-RPCE] Microsoft Corporation, "Remote Procedure Call Protocol Extensions".

[MS-SMB] Microsoft Corporation, "Server Message Block (SMB) Protocol".

[MS-SMB2] Microsoft Corporation, "Server Message Block (SMB) Protocol Versions 2 and 3".

[RFC1088] McLaughlin III, L., "A Standard for the Transmission of IP Datagrams over NetBIOS Networks", STD 48, RFC 1088, February 1989, http://www.ietf.org/rfc/rfc1088.txt

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997, http://www.rfc-editor.org/rfc/rfc2119.txt

1.2.2 Informative References

[MS-DLTM] Microsoft Corporation, "Distributed Link Tracking: Central Manager Protocol".

[MS-GLOS] Microsoft Corporation, "Windows Protocols Master Glossary".

1.3 Overview

The Distributed Link Tracking: Workstation Protocol is based on the RPC runtime, as specified in [C706] and [MS-RPCE], and on the server message block (SMB) protocol and extensions, as specified in [MS-SMB] and [MS-SMB2].

This protocol is used by a client to get a file's identity and location on the server computer as a MachineID, FileID, FileLocation, and Universal Naming Convention (UNC) name. If a client contacts a server that previously stored the file, but the file has been moved to a new computer, the server may be able to return the MachineID of the computer to which the file was moved, so that the client can contact the DLT Workstation server on the new computer to get the file's current UNC and FileLocation, or another referral. This process of following referrals continues until a server returns the file's UNC name and FileLocation, or an error.

Rather than following referrals in this manner, a client may use the Distributed Link Tracking: Central Manager Protocol to determine a file's current MachineID and FileLocation, and then use that information to initiate a call to the DLT Workstation server on the computer indicated by that MachineID. For more information on using the Distributed Link Tracking: Central Manager Protocol in combination with the Distributed Link Tracking: Workstation Protocol, see [MS-DLTM].

The following is a scenario that describes the DLT protocols working together:

1. A file is created on computer M1. M1 assigns identifiers, specifically FileID and FileLocation, to the file.

2. Computer M0 takes note of the file, locally storing its identifiers.

3. The file is moved from computer M1 to M2 and from there to M3. In concert with these moves, the file maintains its FileID but gets a new FileLocation assigned.

4. If the Distributed Link Tracking: Central Manager Protocol is used, clients on computers M1 and M2 notify the server that the file has been moved, indicating the file's FileID and its old and new FileLocation values.

5. Computer M0 finds the file in its new location in one of two ways:

1. Using only the Distributed Link Tracking: Workstation Protocol:

§ M0 contacts M1, using the identifiers stored previously, and learns that the file was moved to M2.