18.104.22.168 Receiving an SMB_COM_LOGOFF_ANDX Request
When the server receives an SMB_COM_LOGOFF_ANDX Request (section 22.214.171.124.1), it MUST first find the UID in the Server.Connection.SessionTable. If the UID is not found in the table, the server MUST return an error response with STATUS_SMB_BAD_UID (ERRSRV/ERRbaduid). If the UID is found, the server MUST release all resources that were opened by the UID specified in the SMB Header (section 126.96.36.199) of the request.
The server MUST deregister the session by invoking the event Server Deregisters a Session ([MS-SRVS] section 188.8.131.52), providing Session.SessionGlobalId as the input parameter. Server.Statistics.sts0_sopens MUST be decreased by 1.
The Server.Connection.SearchOpenTable, Server.Connection.FileOpenTable, and Server.Connection.TreeConnectTable MUST each be traversed in turn.
For each Open in Connection.FileOpenTable, where Open.Session.UID matches the UID field in the request, the server MUST close the Open, release every lock in Open.Locks, remove the Open entry from Server.Connection.FileOpenTable, and deregister that Open, as specified in [MS-SRVS] section 184.108.40.206, providing Open.FileGlobalId as the input parameter. For each closed Open, the server MUST decrease Open.TreeConnect.OpenCount and Server.Statistics.sts0_fopens by 1.
For each SearchOpen in Connection.SearchOpenTable, where SearchOpen.UID matches the UID field in the request, the server MUST close the SearchOpen by removing it from Server.Connection.SearchOpenTable and freeing any resources like the search context.
For each TreeConnect in Server.Connection.TreeConnectTable, where TreeConnect.Session.UID matches the UID field in the request, the server MUST remove the TreeConnect entry from Server.Connection.TreeConnectTable and MUST deregister the TreeConnect by invoking the event specified in [MS-SRVS] section 220.127.116.11 with the tuple <TreeConnect.Share.ServerName, TreeConnect.Share.Name> and TreeConnect.TreeGlobalId as input parameters. For each deregistered TreeConnect, TreeConnect.Share.CurrentUses MUST be decreased by 1.
Resources opened by the specified UID MUST be closed, and the resource entry MUST be removed from the table in which it was found. When all search handles, file handles, and tree connects owned by the UID have been closed, the Server.Session with the matching UID is invalidated and removed from the Server.Connection.SessionTable.