NTFS, etc...

  • Thread starter Thread starter Rob Coop
  • Start date Start date
R

Rob Coop

When looking at file system attributes and stored
information, there are created, modified, and access date-
stamps, but does the file system (or the operating system
of a Shared Drive, either XP with NTFS/EFS or Win2K/NT
Server) store a value of who (either by connected device
name, IP address, or Logged in user) last modified (or
accessed) a file?
<br><br>
A majority of multiuser filesystems that I'm familiar with
seem to only store the owner of the files name (and isn't
this true with NTFS as well?)
<br><br>
Basically my question is:
Is it possible to see who [in any context, machine or
logged in user] last updated a file in NTFS/EFS? If so,
how would this information be accessed?
<br><br>
Thank you,
Rob
 
You could turn on the USN change journal or turn on auditing as long as
you're using NTFS. You need to set this up *before* the file activity you
want to monitor, though. I believe the journaling was added in Win2k/not in
NT4.
 
Where would I find USN and what does it stand for?
-----Original Message-----
You could turn on the USN change journal or turn on auditing as long as
you're using NTFS. You need to set this up *before* the file activity you
want to monitor, though. I believe the journaling was added in Win2k/not in
NT4.
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


When looking at file system attributes and stored
information, there are created, modified, and access date-
stamps, but does the file system (or the operating system
of a Shared Drive, either XP with NTFS/EFS or Win2K/NT
Server) store a value of who (either by connected device
name, IP address, or Logged in user) last modified (or
accessed) a file?
<br><br>
A majority of multiuser filesystems that I'm familiar with
seem to only store the owner of the files name (and isn't
this true with NTFS as well?)
<br><br>
Basically my question is:
Is it possible to see who [in any context, machine or
logged in user] last updated a file in NTFS/EFS? If so,
how would this information be accessed?
<br><br>
Thank you,
Rob
Click to expand...


.
Click to expand...
 
Back
Top