Which process/which user changed the file?

  • Thread starter Thread starter Frank Meng
  • Start date Start date
F

Frank Meng

Hi.

I can use FileSystemEventHandler to monitor file changes.
But how do I know which process/which user changed file?
Is there any information in FileSystemEventArgs?
Or I can get it somewhere else.

Thank you for your help in advance.
Frank
 
The FileSystemEventArgs wont give any such information. I suppose the only
way to get that information is to turn on Security Auditing on that folder.
You will also need to change local secuirty policy to enable specific
auditing functionality. By doing so, you will get highly detailed access
information of all objects for which you have turned on Auditing in the
Secuity Event log.
 
Thank you for your message.
But I want to do it programmatically.
I guess that Windows knows who changed those files.
How does Microsoft do it? Is there an API which users can use?

Frank

Manoj G said:
The FileSystemEventArgs wont give any such information. I suppose the only
way to get that information is to turn on Security Auditing on that folder.
You will also need to change local secuirty policy to enable specific
auditing functionality. By doing so, you will get highly detailed access
information of all objects for which you have turned on Auditing in the
Secuity Event log.

--
HTH,
Manoj G [.NET MVP]
Site: http://www15.brinkster.com/manoj4dotnet
Blog: http://msmvps.com/manoj/

Frank Meng said:
Hi.

I can use FileSystemEventHandler to monitor file changes.
But how do I know which process/which user changed file?
Is there any information in FileSystemEventArgs?
Or I can get it somewhere else.

Thank you for your help in advance.
Frank
Click to expand...
Click to expand...
 
Back
Top