2

I have a console app that checks for changes occurring on the file system. I'm trying to find out if it's possible to get the username of the individual who is doing the changes?

MDL
  • 261
  • 2
  • 12
  • 23
  • This is not possible, all info about the process and its user account is lost by the time the file system sees the changes. – Hans Passant Dec 27 '11 at 21:53
  • With some system-level module this might be possible but not with C# AFAIK. – Yahia Dec 27 '11 at 21:53
  • 1
    @MDL - There was a question asked a week or so ago where someone was trying to accomplish the same thing by reading the Windows audit log. I don't know that they ever got their answer but you might try following up with them. Here's a link to their question: http://stackoverflow.com/questions/8619503/pull-any-machine-specific-information-from-windows-audit-log – M.Babcock Dec 27 '11 at 21:59
  • Have you looked at something like SharePoint as @Darin confirm that its not possible to obtain who modified the document? SharePoint records who and can be setup to have version control + a whole bunch of other useful features. – Kane Dec 27 '11 at 21:59
  • @MDL Maybe you should think to implement a WEBDAV server, it is based on http and Windows(>XP) can see it as a `share` For ex., http://www.webdavsystem.com/server – L.B Dec 27 '11 at 22:19

3 Answers3

4

You'd be better off enabling auditing on the folder.

Right-click the folder, go to Properties > Security tab > Advanced > Auditing tab. There are options for recording an audit log of events that happen in that folder.

Joe White
  • 94,807
  • 60
  • 220
  • 330
  • Unfortunately that would require me to have elevated permissions in order to access the Auditing tab. – MDL Dec 28 '11 at 17:06
0

No, it's not possible, the NTFS or FAT file system which is what Windows uses doesn't record this information. The best you could get about a file is last time it was changed.

Darin Dimitrov
  • 1,023,142
  • 271
  • 3,287
  • 2,928
  • Even if I am connected to a domain? – MDL Dec 27 '11 at 21:53
  • 1
    @MDL, a domain has nothing to do with how files are stored on a Windows OS which is NTFS or FAT which as I already stated in my answer doesn't record this information. Sorry. You can know *when* but not *by whom*. – Darin Dimitrov Dec 27 '11 at 21:54
  • The domain controller certainly doesn't have any idea about these changes. Could you imagine all of the extra metadata being passed around on a machine under even moderate load? – user7116 Dec 27 '11 at 21:55
  • 1
    @MDL, no, there isn't. Well, there isn't in the practical case. You could always write your own file system which records this information but talking from a practical standpoint, there isn't. – Darin Dimitrov Dec 27 '11 at 21:56
  • @MDL That has nothing to do with the domain... it is just how the system works... the kernel knows obviously which process/user accesses/changes/writes a file but that information is not communicated to the filesystem... and it definitely is not communicated from the filesystem to filesystemwatcher... – Yahia Dec 27 '11 at 21:56
  • @MDL The only workaround is writing some kernel-level module which sits between any process accessing the filesystem and the kernel-side filesystem-code - it is possible but NOT from C# . – Yahia Dec 27 '11 at 21:57
  • seen this question before and it's possible but he would have to look at implementing / using WMI as well as capturing or writing soem code to get the Domain User.. – MethodMan Dec 27 '11 at 21:57
  • @MDL ... or a filesystem filter driver – Eugene Mayevski 'Callback Dec 28 '11 at 09:05
0

You can't do this asynchronously with FileSystemWatcher, however you can do this synchronously using file system filter driver. The driver lets you get the user name of the account performing the operation.

Eugene Mayevski 'Callback
  • 45,135
  • 8
  • 71
  • 121