I wanna control access from remote(ex, access to shared-folder) in my file
system filter.
I started my driver from filemon of sysinternals.com.
All requests from local were filtered in IRP_MJ_CREATE.
But, There was no trace in IRP_MJ_CREATE, when i accessed shared-folder
from remote computer.
Only FastIoQueryNetworkOpenInfo routine was called.
That is, I cannot filter IRP_MJ_CREATE access from remote(when i access
shared-folder).
What’s the problem and how should i solve?