FileSystemWatcher
-
I have written an application using FileSystemWatcher and put the Windows Service on our data server. Now my question is, using FileSystemWatcher, is there a way to get the windows logon name that actually deleted the file? I realy want to know who deleted or created the files. Is this possible?
-
I have written an application using FileSystemWatcher and put the Windows Service on our data server. Now my question is, using FileSystemWatcher, is there a way to get the windows logon name that actually deleted the file? I realy want to know who deleted or created the files. Is this possible?
-
Depending on what Windows Server OS you have and how it's configured (NTFS I think) I believe Windows is capable of auditing the File System. You need to configure it of course.
Our data server is running Server 2008 x64. So are you saying Windows has something built in instead of writing an app for it?
-
Our data server is running Server 2008 x64. So are you saying Windows has something built in instead of writing an app for it?
-
Jacob D Dixon wrote:
So are you saying Windows has something built in instead of writing an app for it?
Yes, I've never used it so I don't know where the MMC is located. It will write entries into the Security Log.
Ohh! Your talking about the File Screening. I think that just monitors saving files not deleting. I currently use that to block non image files from being saved to our images drive. Or are you speaking of somethign else? I guess I'm still wondering if using FileSystemWatcher can get the users login name?
-
Ohh! Your talking about the File Screening. I think that just monitors saving files not deleting. I currently use that to block non image files from being saved to our images drive. Or are you speaking of somethign else? I guess I'm still wondering if using FileSystemWatcher can get the users login name?
-
Jacob D Dixon wrote:
Ohh! Your talking about the File Screening. I think that just monitors saving files not deleting.
No, I'm talking about File System Auditing and it can Audit just about everything I believe.
Ok I see what you are talking about. Thanks... I'm still curious if the FileSystemWatcher can do something like that.
-
I have written an application using FileSystemWatcher and put the Windows Service on our data server. Now my question is, using FileSystemWatcher, is there a way to get the windows logon name that actually deleted the file? I realy want to know who deleted or created the files. Is this possible?
Yes, just get the currently logged on user name at the time you detect a file being deleted.
"Why don't you tie a kerosene-soaked rag around your ankles so the ants won't climb up and eat your candy ass..." - Dale Earnhardt, 1997
-----
"...the staggering layers of obscenity in your statement make it a work of art on so many levels." - Jason Jystad, 10/26/2001 -
Yes, just get the currently logged on user name at the time you detect a file being deleted.
"Why don't you tie a kerosene-soaked rag around your ankles so the ants won't climb up and eat your candy ass..." - Dale Earnhardt, 1997
-----
"...the staggering layers of obscenity in your statement make it a work of art on so many levels." - Jason Jystad, 10/26/2001The Windows Service that I made goes on a Data Server. The way everyone accesses it is by mapping a network drive (to the Data server) on their desktop PC's. So on the server using FileSystemWatcher can you get their information? The service is running under local system, but the person actually doing the deleting will be using a desktop PC that just has that network drive mapped. How do I get that person's logon name to log that they were the ones that deleted it?
-
I have written an application using FileSystemWatcher and put the Windows Service on our data server. Now my question is, using FileSystemWatcher, is there a way to get the windows logon name that actually deleted the file? I realy want to know who deleted or created the files. Is this possible?
Power Threading Library[^] library includes class for reading NTFS change journal
Giorgi Dalakishvili #region signature My Articles Asynchronous Registry Notification Using Strongly-typed WMI Classes in .NET [^] My blog #endregion
