Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > Process Monitor
  New Posts New Posts RSS Feed - Simple Question
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Simple Question

 Post Reply Post Reply
Author
Message
dan View Drop Down
Newbie
Newbie


Joined: 18 February 2010
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote dan Quote  Post ReplyReply Direct Link To This Post Topic: Simple Question
    Posted: 18 February 2010 at 12:21am
Forgive my ignorance, but I have a question:

I am running procmon on two different PCs.  When I open a program (in this case, Thunderbird) on PC #1, I get this:



When I open a program on the other PC #2, I get this:



As you can see, PC #2 performs the "QueryNameInformationFile" operation and PC #2 does not.  I tried googling "querynameinformationfile" but I didn't have much luck figuring out what it meant.  I am hoping somebody on this forum is knowledgeable enough to let me know.
Back to Top
snoone View Drop Down
Senior Member
Senior Member


Joined: 04 September 2009
Location: Amherst, NH
Status: Offline
Points: 330
Post Options Post Options   Thanks (0) Thanks(0)   Quote snoone Quote  Post ReplyReply Direct Link To This Post Posted: 18 February 2010 at 12:04pm

That's an IRP_MJ_QUERY_INFORMATION for FileNameInformation request. See:

 
 
-scott
Back to Top
dan View Drop Down
Newbie
Newbie


Joined: 18 February 2010
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote dan Quote  Post ReplyReply Direct Link To This Post Posted: 18 February 2010 at 7:31pm
Thank You!

Thanks for the info!  I'd ask why one computer queries the file name and the other does not but I have a feeling that the only way I could understand the answer to that question is to study.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down