PowerShell / PowerShell/Win32-OpenSSH

open handles to users registry files make it impossible to delete user profile after ssh connection

Open
#1,694 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

"OpenSSH for Windows" version

7.7.2.2

Server OperatingSystem

Windows Server 2019 Standard
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)

Client OperatingSystem
Windows 10

What is failing

When a connection to the SSH server has been closed, the user profile of the user persistently keeps handles open into the specific users registry files on the server. Even after stopping sshd it is e.g. not possible to delete the users profile until you reboot the server.

To reproduce, create a local user on the server (e.g. sftp). Establish an SSH connection to the server using this user. Close the SSH session. Stop SSHD. Try to delete the users profile via Advanced system settings GUI. The Delete button is grayed out because of the still opened handles to the users registry.

Expected output

All handles should be closed to make it possible to delete the user profile.

Actual output

Here is the result of handle64.exe after stop sshd and user is no longer logged in (username: sftp.

C:\>handle64.exe -a | findstr /i "sftp"
 135C: File  (---)   C:\Users\sftp\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
 1CB0: File  (R--)   C:\Users\sftp\AppData\Local\Microsoft\Windows\UsrClass.dat{c7f32395-181e-11eb-8bf9-00505699b0d3}.TMContainer00000000000000000001.regtrans-ms
 1CD8: File  (R--)   C:\Users\sftp\NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TMContainer00000000000000000001.regtrans-ms
 1E24: File  (---)   C:\Users\sftp\NTUSER.DAT
 2104: File  (R--)   C:\Users\sftp\AppData\Local\Microsoft\Windows\UsrClass.dat{c7f32395-181e-11eb-8bf9-00505699b0d3}.TMContainer00000000000000000002.regtrans-ms
 2178: File  (R--)   C:\Users\sftp\AppData\Local\Microsoft\Windows\UsrClass.dat{c7f32395-181e-11eb-8bf9-00505699b0d3}.TM.blf
 22D8: File  (---)   C:\Users\sftp\AppData\Local\Microsoft\Windows\UsrClass.dat
 2614: File  (---)   C:\Users\sftp\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
 2648: File  (R--)   C:\Users\sftp\NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TM.blf
 2734: File  (---)   C:\Users\sftp\ntuser.dat.LOG2
 27C0: File  (R--)   C:\Users\sftp\NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TMContainer00000000000000000002.regtrans-ms
 2B08: File  (---)   C:\Users\sftp\ntuser.dat.LOG1
 1BEC: Token         MYSERVER\sftp:11aabc8f

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source files or tests are named. Reproduce the issue by opening and closing an SSH session, stopping sshd, and checking the user's registry handles with handle64.exe; done means the profile can be deleted without rebooting the server.

Written by the indexing model from the issue text.

Assessment

Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.