Checking what user has accessed a file (.Net)

GEC: Discuss gaming, computers and electronics and venture into the bizarre world of STGODs.

Moderator: Thanas

Post Reply
User avatar
atg
Jedi Master
Posts: 1418
Joined: 2005-04-20 09:23pm
Location: Adelaide, Australia

Checking what user has accessed a file (.Net)

Post by atg »

For a quick project I'm working on in VB.Net I want to track when users have accessed a file. Example:

testfile.txt exists on a drive. When a user opens or edits the file, I wish to record what time and who edited it.

I've been able to use the FileSystemWatcher to determine when the file is edited, etc, but I'm trying to work out how to determine what user accessed it.

As far as programming goes its only really a hobby for me so any help would be much appreciated.
User avatar
Ace Pace
Hardware Lover
Posts: 8456
Joined: 2002-07-07 03:04am
Location: Wasting time instead of money
Contact:

Post by Ace Pace »

Probably relies on event logging of security events being enabled, but pull the event log and work backwards, whats the last user that logged on.
I'm pretty sure .Net has capability for that, I could look up MSDN for you.

Another method is probably getting the active user from the shell, this should be possible, though probably by importing another DLL. :?
Brotherhood of the Bear | HAB | Mess | SDnet archivist |
User avatar
Xon
Sith Acolyte
Posts: 6206
Joined: 2002-07-16 06:12am
Location: Western Australia

Post by Xon »

Enable audit logging (local security policy) and then enable audit logging in on the files in question.

This will record accesses to various things, will generate a double-wide metric fuckton of eventlogs.
"Okay, I'll have the truth with a side order of clarity." ~ Dr. Daniel Jackson.
"Reality has a well-known liberal bias." ~ Stephen Colbert
"One Drive, One Partition, the One True Path" ~ ars technica forums - warrens - on hhd partitioning schemes.
User avatar
atg
Jedi Master
Posts: 1418
Joined: 2005-04-20 09:23pm
Location: Adelaide, Australia

Post by atg »

Xon wrote:Enable audit logging (local security policy) and then enable audit logging in on the files in question.

This will record accesses to various things, will generate a double-wide metric fuckton of eventlogs.
Sounds like the best way to go. Thanks for the advice.
Post Reply