CODEWITHSUNDEEP
winapifilesystemsnotificationsntfs
aep400
aep400

Reputation: 11

Getting Extra Information From WinAPI File Change Notifications

The MSDN has a pretty good example of getting notified when a file or directory is changed.

However, I can't find any way to get extra information such as the user/machine name associated with the change notification.

For example, I've setup a share X:\Foo from my machine. I would like to log the user/machine names that make changes to my shared directory.

Is this possible to accomplish?

Upvotes: 1

Views: 469

Answers (1)

Larry Osterman
Larry Osterman

Reputation: 16142

You can't using FFCN. You can set the security descriptor on the files in the shared directory to cause file accesses to be logged to the event log.

This KB article has some information about how to enable auditing on files.

Upvotes: 1

Related Questions