How to identify registry operations are redirected/reflected?

Question

When we register registry callbacks using CmRegisterCallbackEx, how to identify callbacks we receive for registry operation are redirected/reflected?

Answer 1

CmRegisterCallbackEx will call your function for every operation. It is your functions responsibility to handle the operations it needs to and to return STATUS_SUCCESS for operations that it doesn't handle so that Windows knows to call the next filter in the stack. You can read a bit more about this at this link: Registry Filter Drivers (Part 1).