use the FileSystemWatcher class to document the user who is making changes

Asked 27/12, 2011 at 21:51 Answered 28/12, 2011 at 8:20

c#io filesystems filesystemwatcher user-management

I have a console app that checks for changes occurring on the file system. I'm trying to find out if it's possible to get the username of the individual who is doing the changes?

Advancement answered 27/12, 2011 at 21:51 Comment(5)

This is not possible, all info about the process and its user account is lost by the time the file system sees the changes. – Pinky 27/12, 2011 at 21:53

With some system-level module this might be possible but not with C# AFAIK. – Intreat 27/12, 2011 at 21:53

@Advancement - There was a question asked a week or so ago where someone was trying to accomplish the same thing by reading the Windows audit log. I don't know that they ever got their answer but you might try following up with them. Here's a link to their question: #8620003 – Hexagon 27/12, 2011 at 21:59

Have you looked at something like SharePoint as @Darin confirm that its not possible to obtain who modified the document? SharePoint records who and can be setup to have version control + a whole bunch of other useful features. – Washing 27/12, 2011 at 21:59

@Advancement Maybe you should think to implement a WEBDAV server, it is based on http and Windows(>XP) can see it as a share For ex., webdavsystem.com/server – Magyar 27/12, 2011 at 22:19

You'd be better off enabling auditing on the folder.

Right-click the folder, go to Properties > Security tab > Advanced > Auditing tab. There are options for recording an audit log of events that happen in that folder.

Raseta answered 27/12, 2011 at 22:0 Comment(1)

Unfortunately that would require me to have elevated permissions in order to access the Auditing tab. – Advancement 28/12, 2011 at 17:6

No, it's not possible, the NTFS or FAT file system which is what Windows uses doesn't record this information. The best you could get about a file is last time it was changed.

Virendra answered 27/12, 2011 at 21:52 Comment(8)

Even if I am connected to a domain? – Advancement 27/12, 2011 at 21:53

@MDL, a domain has nothing to do with how files are stored on a Windows OS which is NTFS or FAT which as I already stated in my answer doesn't record this information. Sorry. You can know when but not by whom. – Virendra 27/12, 2011 at 21:54

The domain controller certainly doesn't have any idea about these changes. Could you imagine all of the extra metadata being passed around on a machine under even moderate load? – Bronchia 27/12, 2011 at 21:55

@MDL, no, there isn't. Well, there isn't in the practical case. You could always write your own file system which records this information but talking from a practical standpoint, there isn't. – Virendra 27/12, 2011 at 21:56

@Advancement That has nothing to do with the domain... it is just how the system works... the kernel knows obviously which process/user accesses/changes/writes a file but that information is not communicated to the filesystem... and it definitely is not communicated from the filesystem to filesystemwatcher... – Intreat 27/12, 2011 at 21:56

@Advancement The only workaround is writing some kernel-level module which sits between any process accessing the filesystem and the kernel-side filesystem-code - it is possible but NOT from C# . – Intreat 27/12, 2011 at 21:57

seen this question before and it's possible but he would have to look at implementing / using WMI as well as capturing or writing soem code to get the Domain User.. – Perdita 27/12, 2011 at 21:57

@Advancement ... or a filesystem filter driver – Fodder 28/12, 2011 at 9:5

You can't do this asynchronously with FileSystemWatcher, however you can do this synchronously using file system filter driver. The driver lets you get the user name of the account performing the operation.

Jequirity answered 28/12, 2011 at 8:20 Comment(0)

Recommended topics

Hot tags