original requestor for n/w io

in the case of Io coming through teh srv, like real SMB share IO requests,
or perhaps the localhost being redirected through smb (\localhost\C$) the
create request to open a file comes to the minifilter as a kernel request
from SRV. Is there a way to find who the original requwestor was (assuming
it is a local use trying to use \\c$ or \localhost\c$ to open
the c driver instead of a regular createFile?

Check the SRV_OPEN_ECP_CONTEXT and see if that works for you: