Thank you Dejan, but maybe I should provide more details to be clear about what I want to achieve.
Let’s say a text file was opened with write access (https://community.osr.com/discussion/77714/irp-mj-create-with-write-access) by WordPad, users can view the content, but I want the file filter to conditionally block the changes made by the users when they are trying to save the file. I should still do that in Pre-Create rather than Pre-Write?
As the link (I posted earlier) described, we can find the file was opened with write access in IRP_MJ_CREATE, but how can we tell if the user is actually trying to save the file? Using Irp->IoStatus.Information?
And how should I abort write in Pre-Create, like below?
Data->IoStatus.Status = STATUS_CANCELLED;
Data->IoStatus.Information = 0;
return FLT_PREOP_COMPLETE;
Following previous post, I can differentiate when user is trying to save the file by checking write access. However, the dialogs for “save as” still prompt after I return FLT_PREOP_COMPLETE with status = STATUS_CANCELLED or STATUS_ACCESS_DENIED in pre-create.
Should I do something in post-cteate or CLEANUP / CLOSE in order to get rid of the prompt?