A customer used the Read­Directory­ChangesW function to monitor a directory for changes, asking for notifications only for changes directly in the directory being monitored (bWatchSubtree = false). But they found that the Read­Directory­ChangesW function reported a change even when they created a file in a subdirectory, rather than in the directory being monitored.

For example, if they asked to monitor the directory C:\dir1, and a file was created at C:\dir1\dir2\file, the Read­Directory­ChangesW function reported a change, even though the file was created in a subdirectory, and the request was for a non-recursive monitor.

What gives?

We saw some time ago that the purpose of the Read­Directory­ChangesW function is to allow you to maintain a local copy of the contents of a directory: The idea is that you make an initial pass over the directory with Find­First­File/Find­Next­File, and then you use the notifications from the Read­Directory­ChangesW function to make incremental updates to your local copy.

And what happened here is that the contents of an enumeration of the C:\dir1 directory did in fact change. What changed is the last-modified date on C:\dir1\dir2!