How do I know which user initiated a filesystem event?

To determine which user initiated a filesystem request, call the GetOriginatorToken method during the event, and then use the Windows security token it returns to call the Windows API function GetTokenInformation, which will allow you to retrieve various security-related information about the request originator (such as the associated user account).

Note that the GetOriginatorToken method is not available in the CBMonitor component; and for the CBFilter component, it will not work in the Notify* events. Refer to this article for more information.