Menu
I need to know which user deleted file in filesystem from c# code. Only one idea is to use audit, but it seem to be very slow...
280
Open the Event Viewer and search the security log for event ID 4656 with a task category of "File System" or "Removable Storage" and the string "Accesses: DELETE". Review the report. The "Subject: Security ID" field will show who deleted each file.
Now, open Windows Event Viewer and go to “Windows Logs” – “Security”. Use the “Filter Current Log” option to find events having Events ID 4660 for file and folder deletions. In the following image, you can see the event id 4660 which has been logged after a folder has been deleted.
You can use the FileSystemWatcher.Deleted event to capture deletes happening on the filesystem.
Depending on the application, you may at that point also be able to find out what user caused this event to occur (it is not part of FileSystemEventArgs).
91
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
