diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c
index 17713f0..b73b6f9 100644
--- a/source3/modules/vfs_full_audit.c
+++ b/source3/modules/vfs_full_audit.c
@@ -65,6 +65,7 @@
 #include "auth.h"
 #include "ntioctl.h"
 
+extern struct current_user current_user;
 static int vfs_full_audit_debug_level = DBGC_VFS;
 
 struct vfs_full_audit_private_data {
@@ -393,6 +394,7 @@ static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
 {
 	char *prefix = NULL;
 	char *result;
+	struct auth_serversupplied_info *session_info;
 
 	prefix = talloc_strdup(ctx,
 			lp_parm_const_string(SNUM(conn), "full_audit",
@@ -400,13 +402,19 @@ static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
 	if (!prefix) {
 		return NULL;
 	}
+	if(conn->session_info){
+		session_info = conn->session_info;
+	}else{
+		/* conn->session_info is NULL when connect msdfs */
+		session_info = current_user.conn->session_info;
+	}
 	result = talloc_sub_advanced(ctx,
 			lp_servicename(SNUM(conn)),
-			conn->session_info->unix_name,
+			session_info->unix_name,
 			conn->connectpath,
-			conn->session_info->utok.gid,
-			conn->session_info->sanitized_username,
-			conn->session_info->info3->base.domain.string,
+			session_info->utok.gid,
+			session_info->sanitized_username,
+			session_info->info3->base.domain.string,
 			prefix);
 	TALLOC_FREE(prefix);
 	return result;