I’m writing this because the WDK documentation left things out.
This API: IoCreateSynchronizationEvent says that you have two options to share an Event with user-mode application: 1. The process creates an event and sends the handle to the driver (more secure) and 2. Use named events.
The documentation says that named evevnts require “\\BaseNamedObjects\Xxx” on the driver’s side and “xxx” on the process side. This should be “\BaseNamedObjects\Xxx” with one back-slash. Your code should look like this “\\BaseNamedObjects\\Xxx” and not like this: “\\\\BaseNamedObjects\\Xxx“
Also I found that the user space process created the Named Event under “\Sessions\1\BaseNamedObjects\Xxx” where 1 is the Session ID and Xxx is the Event Name.
Using an administrator account, not running the process using “Run as administrator” this works.