How do I know which user initiated a file system event?

Use the GetOriginatorToken method of the CBFS Filter class to get the security token of the process. You can use the security token to retrieve various security-related information using the GetTokenInformation function of the Windows API.

Ready to get started?

Learn more about Callback Technologies or download a free trial.

Download Now