Delayed-Write Buffers Lost When Impersonate Token Closed

• Microsoft Windows NT Workstation versions 3.51 and 4.0
• Microsoft Windows NT Server versions 3.51 and 4.0

SYMPTOMS

After a service or application goes through the following three steps:

1. The service (or application) has a thread that impersonates a user and

1. Once logged on, the service (or application) opens or creates a file on

1. Data is written to the file, the file is closed, and the thread then

then the following error message is displayed:

   System Process: Lost Delayed-Write Data.

CAUSE

When a file is opened, it will use write-back caching by default. This means that when data is written to the file, it is written to the cache, but not immediately to the file. The cache manager will flush the data to the file at a later time. When the thread issues the logoff request, the logoff request may be sent to the remote server before the cache manager flushes the data to the file (opened with a UNC path name). When the user log off completes, the file handle will no longer be valid. Later, when the cache manager flushes the data to the file server, it receives the error C0000008 (STATUS_INVALID_HANDLE) and then reports the error "System Process: Lost Delayed-Write Data."

RESOLUTION

When opening or creating the file, use the FILE_FLAG_WRITE_THROUGH flag. This will inform the redirector not to cache write data.

STATUS

Microsoft has confirmed this to be a problem in Windows NT versions 3.51 and 4.0. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.