Which process/which user changed the file?

[Frank Meng]

Hi.

I can use FileSystemEventHandler to monitor file changes.
But how do I know which process/which user changed file?
Is there any information in FileSystemEventArgs?
Or I can get it somewhere else.

Thank you for your help in advance.
Frank

 

[Manoj G [MVP]]

The FileSystemEventArgs wont give any such information. I suppose the only
way to get that information is to turn on Security Auditing on that folder.
You will also need to change local secuirty policy to enable specific
auditing functionality. By doing so, you will get highly detailed access
information of all objects for which you have turned on Auditing in the
Secuity Event log.

 

[Frank Meng]

Thank you for your message.
But I want to do it programmatically.
I guess that Windows knows who changed those files.
How does Microsoft do it? Is there an API which users can use?

Frank

The FileSystemEventArgs wont give any such information. I suppose the only
way to get that information is to turn on Security Auditing on that folder.
You will also need to change local secuirty policy to enable specific
auditing functionality. By doing so, you will get highly detailed access
information of all objects for which you have turned on Auditing in the
Secuity Event log.

--
HTH,
Manoj G [.NET MVP]
Site: http://www15.brinkster.com/manoj4dotnet
Blog: http://msmvps.com/manoj/

Hi.

I can use FileSystemEventHandler to monitor file changes.
But how do I know which process/which user changed file?
Is there any information in FileSystemEventArgs?
Or I can get it somewhere else.

Thank you for your help in advance.
Frank