Getting Extra Information From WinAPI File Change Notifications

Question

The MSDN has a pretty good example of getting notified when a file or directory is changed.

However, I can't find any way to get extra information such as the user/machine name associated with the change notification.

For example, I've setup a share X:\Foo from my machine. I would like to log the user/machine names that make changes to my shared directory.

Is this possible to accomplish?

Answer 1

You can't using FFCN. You can set the security descriptor on the files in the shared directory to cause file accesses to be logged to the event log.

This KB article has some information about how to enable auditing on files.