The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Lets say that we have written a minifilter driver that needs to do stuff in its pre/post IRP_MJ_CLEANUP callbacks when a file is closed.
A problem arises when we have a file inside a shared folder. in this case, it seems like IRP_MJ_CLEANUP could never get called when the file is deleted by a remote host. how to resolve this issue?
Overall, how does network shared folders work with minifilters? for example if i want to monitor write operations on files, and a remote process/host does the modification, then my pre write callback will never get called, right? how to properly deal with this?