Monitor Windows

[Guest]

Can I write a windows service in .NET that monitors what happens on a server?

(e.g.. which applications where started, what files where accessed, registry
changes,...)

 

[Tom Spink]

Can I write a windows service in .NET that monitors what happens on a
server?

(e.g.. which applications where started, what files where accessed,
registry changes,...)

Hi Rui,

Just to clarify, do you mean the service will be running *on* the machine
you want to monitor? Or you want to monitor a remote machine?

 

[Guest]

Yes, the service will be running on the machine and will log all the actions
performed on a file.

 

[Michael Nemtsev]

Hello Rui,

It can be set via Windows.
File properties->Security Tab->Advances button->Auditing tab

Or use FileSystemWatcher class

R> Yes, the service will be running on the machine and will log all the
R> actions performed on a file.
R>
R> "Tom Spink" wrote:
R>---
WBR,
Michael Nemtsev :: blog: http://spaces.msn.com/laflour

"At times one remains faithful to a cause only because its opponents do not
cease to be insipid." (c) Friedrich Nietzsche

 

[Tom Spink]

Yes, the service will be running on the machine and will log all the
actions performed on a file.

Well, for file changes, the FileSystemWatcher class will probably be of some
use to you. As for when applications are started, that's a bit more
complex. There's no concrete event you can subscribe to, in order to get
such notifications. To ensure you get all process creation notifications,
the best way (that I know of) involves native DLLs and code injection, to
trap calls to CreateProcess (or in extreme cases NtCreateProcess).
Obviously, this technique is not possible in C# (or any .NET language).