How to find out who modified a shared directories and files in C# or Powershell?

Question

I am designing a Windows Service which main purpose is to monitor content of network shares. I've already got to know pros and cons of FileSystemWatcher class and probably I am going to use it with some custom enhancement. One thing that bothers me is that I still don't know how to get the information about who exactly modified shared files. I think it could be extracted somehow from permissions mechanism in Windows, but how? Have you got any ideas how to get at least login of the person who accessed and modified shared content? I can use either C# or PowerShell.

Looks like a duplicate of [stackoverflow.com/questions/11660235/](http://stackoverflow.com/questions/11660235/) — KeyNone, Aug 25 '15 at 13:34
Looks like that to me too, but I'm not sure that it will work on network drives. — Matthew Watson, Aug 25 '15 at 13:45
Right. Sorry. It seems that I haven't searched for the answer effectively enough. — Dawid, Aug 26 '15 at 09:41

score 2 · Accepted Answer · answered Aug 25 '15 at 14:19

2

The best way to do this is to enable advanced file auditing on the servers you need this information on. If that isn't an option (it can get quite inefficient on servers with high disk IO), you can try using FileSystemWatcher to get the same results. Here is an example of how to do that!

answered Aug 25 '15 at 14:19

Carlos Nunez

2,047
1
18
20

I know this script. It only shows what and when was modified, not by whom. – Dawid Aug 26 '15 at 09:44

How to find out who modified a shared directories and files in C# or Powershell?

1 Answers1