Menu
I was asked to find a way to monitor changes (modification, renaming, deletion, moving) of files in specific folders on the company's shared file server (simple windows shared directory). I wrote a simple app in C# that uses FileSystemWatcher to monitor these changes and notify a particular email address of them.
What I'd like to know now is how to find out the name/IP of the user/computer who made these changes. Any ideas?
As an alternative to writing my own software, are there any good (possibly free) software that supports this functionality?
799
Step 2 – Right-click the folder or file and click “Properties” in the context menu. Step 3 – Switch to “Security” tab and click “Advanced”. Step 4 – In the “Permissions” tab, you can see the permissions held by users over a particular file or folder.
To see who reads the file, open “Windows Event Viewer”, and navigate to “Windows Logs” → “Security”. There is a “Filter Current Log” option in the right pane to find the relevant events. If anyone opens the file, event ID 4656 and 4663 will be logged.
Use auditing - it's on the security tab when you get the properties of file/folder. You specify which users you want audited for what kind of access. You also have to turn on auditing using the security policy mmc snap-in. The audits will end up in the security log.
Detailed instructions from MS: http://support.microsoft.com/kb/310399
If you want, your C# app could then pick the events out of the security event log.
167
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
