Find out WHO made the last change to files by Powershell?

Question

I have a shared network location for all users saving files. All users have full access to this location.

Is that possible to find out WHO made the last change to a file or folder by Powershell or any other way?

There is no issue to get all those date and owner info from Powershell, but looks like there is no way to find out WHO made the last changes.

any idea please?

Gossipy

Answer 1

The only user held against a file on NTFS is the owner. There is no record of who last modified the file.

However Windows can audit file system operations.

See http://support.microsoft.com/en-us/kb/310399 (says Windows XP in the title but applies to later versions). This needs to be applied to the system hosting the file system.

Horsley

Does this audit function give system extra burden ? consuming a lot of system resources? – Gossipy

@RootLoop Clearly there is some overhead, but if you do not include read only operations (ie. only audit create/modify/delete) then it should be small. But the only way to really see the overhead is to try it. If the server is not already overloaded I would expect not to have an issue. Remember, also, to increase the size of the system event log to be big enough to hold enough history. – Horsley