I need to monitor file operations on the server. Is this possible with CallbackFilter?
CallbackFilter (driver) must be installed on the computer that you need to monitor. Also you can monitor mounted remote disks, but only for operations that originate from the computer where CallbackFilter is installed.
Example: if you have a server S to monitor and you have two clients (C1 and C2), you have the following options:
1) install CallbackFilter on S
2) install CallbackFilter on C1 and C2 to track operations on disks shared by S when such operations are performed on C1 and C2 accordingly.
If you install the driver only on C1, you will be able to capture operations that are performed on S only by C1 but not by C2.