I have a top-level minifilter driver and a user-mode service, which is similar to the Scanner MSDN example.
I want my user-mode service to replace the
Instead of notifying to your service in on PostOperation, do that in PreOperation callback. By the time you do that in PostOperation file will be already opened for Notepad.exe, which is why open in your service is failing.
Also, if you are not doing already, you would have to wait in PreOperation while your service writes new data to the file.