Determining user that caused FileSystemWatcher event to fire within a Windows Service

[chad.poplawski]

Hi All,

I'm working on a Windows Service that uses FileSystemWatcher components
to capture and log data when certain actions (such as files being
deleted) take place in the file system. I am trying to figure out how
to obtain the WindowsIdentity (User Name, Login, etc.) of the actual
user that performed the action (for example, DOMAINNAME\CPoplawski
deleted a file). Simply retrieving the WindowsIdentity within the
service does not work, as it returns SYSTEM because the service runs
under the Local System account. Is there any way, maybe similar to
Impersonation in ASP.Net, to accomplish this?

Regards,

Chad Poplawski

 

[Guest]

Hi I have a similar problem,

I have the watcher running on my DC. I want to monitor the shared folders.
When a user is mapped to these folders and Delete a file that resides on my
DC

Below code returns DOMAIN\Administrator

//Get the current identity and put it into an identity object.
WindowsIdentity MyIdentity = WindowsIdentity.GetCurrent();

//Put the previous identity into a principal object.
WindowsPrincipal MyPrincipal = new WindowsPrincipal(MyIdentity);

//Principal values.
string Name = MyPrincipal.Identity.Name;

//Identity values.
string IdentName = MyIdentity.Name;

Console.WriteLine("\n\nPrincipal Name: {0}", Name);
Console.WriteLine("Identity Name: {0}", IdentName);

The Name and IdentName returns DOMAIN\Administrator while in fact I am
expecting DOMAIN\mhallin.

I aslo tried
Environment.UserName but this returns Administrator without the DOMAIN name.

Does anyone have an idea on how I can get around this and retrieve the
correct username?