How do you monitor file access and changes on a file server by user name?

Question

I was asked to find a way to monitor changes (modification, renaming, deletion, moving) of files in specific folders on the company's shared file server (simple windows shared directory). I wrote a simple app in C# that uses FileSystemWatcher to monitor these changes and notify a particular email address of them.

What I'd like to know now is how to find out the name/IP of the user/computer who made these changes. Any ideas?

As an alternative to writing my own software, are there any good (possibly free) software that supports this functionality?

Answer 1

Use auditing - it's on the security tab when you get the properties of file/folder. You specify which users you want audited for what kind of access. You also have to turn on auditing using the security policy mmc snap-in. The audits will end up in the security log.

Detailed instructions from MS: http://support.microsoft.com/kb/310399

If you want, your C# app could then pick the events out of the security event log.

Answer 2

Hi Firas,

I have a similar task...to monitor file access in a directory and notify some email user. Can you please let me know how you did it? The monitoring part.

Thanks