Showing results for April 18, 2013 - The Old New Thing

The function will tell you when a file was last modified, but it won't tell you who did it. Neither will , , or , or . None of these the file system functions will tell you which user modified a file because the file system doesn't keep track of which user modified a file. But there is somebody who does keep track: The security event log. To ...