Remote access notification for a file opened from shared folder.

NTFSD
1

I have shared a folder on a machine where file system driver is running.

I get notifications in driver when this file is accessed remotely but how to differentiate if the file is being accessed remotely or locally?

Is there any flag which is received in PreCreate/PostCreate to notify that this file is being accessed remotely?

2

See GUID_ECP_SRV_OPEN

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/system-defined-ecps

-scott
OSR
@OSRDrivers

3

Thank you for the information Scott.