{"id":4623,"date":"2013-04-18T07:00:00","date_gmt":"2013-04-18T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2013\/04\/18\/how-can-i-figure-out-which-user-modified-a-file\/"},"modified":"2013-04-18T07:00:00","modified_gmt":"2013-04-18T07:00:00","slug":"how-can-i-figure-out-which-user-modified-a-file","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20130418-00\/?p=4623","title":{"rendered":"How can I figure out which user modified a file?"},"content":{"rendered":"

The Get­File­Time<\/code> function will tell you when<\/i> a file was last modified, but it won’t tell you who did it. Neither will Find­First­File<\/code>, Get­File­Attributes<\/code>, or Read­Directory­ChangesW<\/code>, or File­System­Watcher<\/code>.<\/p>\n

None of these the file system functions will tell you which user modified a file because the file system doesn’t keep track of which user modified a file. But there is somebody who does<\/i> keep track: The security event log. <\/p>\n

To generate an event into the security event log when a file is modified, you first need to enable auditing on the system. In the Local Security Policy<\/i> administrative tool, go to Local Policies<\/i>, and then double-click Audit Policy<\/i>. (These steps haven’t changed since Windows 2000<\/a>; the only thing is that the Administrative Tools folder moves around a bit<\/a>.) Under Audit Object Access<\/i>, say that you want an audit raised when access is successfully granted by checking Success (An audited security access attempt that succeeds)<\/i>. <\/p>\n

Once auditing is enabled, you can then mark the files that you want to track modifications to. On the Security<\/i> tab of each file you are interested in, go to the Auditing<\/i> page, and select Add<\/i> to add the user you want to audit. If you want to audit all accesses, then you can choose Everyone<\/i>; if you are only interested in auditing a specific user or users in specific groups, you can enter the user or group. <\/p>\n

After specifying whose access you want to monitor, you can select what actions should generate security events. In this case, you want to check the Successful<\/i> box next to Create files \/ write data<\/i>. This means “Generate a security event when the user requests and obtains permission to create a file (if this object is a directory) or write data (if this object is a file).” <\/p>\n

If you want to monitor an entire directory, you can set the audit on the directory itself and specify that the audit should apply to objects within the directory as well. <\/p>\n

After you’ve set up your audits, you can view the results in Event Viewer<\/i>. <\/p>\n

This technique of using auditing to track who is generating modifications also works for registry keys: Under the Edit<\/i> menu, select Permissions<\/i>. <\/p>\n

Exercise<\/b>: You’re trying to debug a problem where a file gets deleted mysteriously, and you’re not sure which program is doing it. How can you use this technique to log an event when that specific file gets deleted? <\/p>\n","protected":false},"excerpt":{"rendered":"

The Get­File­Time function will tell you when a file was last modified, but it won’t tell you who did it. Neither will Find­First­File, Get­File­Attributes, or Read­Directory­ChangesW, or File­System­Watcher. None of these the file system functions will tell you which user modified a file because the file system doesn’t keep track of which user modified a […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-4623","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"

The Get­File­Time function will tell you when a file was last modified, but it won’t tell you who did it. Neither will Find­First­File, Get­File­Attributes, or Read­Directory­ChangesW, or File­System­Watcher. None of these the file system functions will tell you which user modified a file because the file system doesn’t keep track of which user modified a […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/4623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=4623"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/4623\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=4623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=4623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=4623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}