How to find out who modified a shared directories and files in C# or Powershell?

Question

I am designing a Windows Service which main purpose is to monitor content of network shares. I've already got to know pros and cons of FileSystemWatcher class and probably I am going to use it with some custom enhancement. One thing that bothers me is that I still don't know how to get the information about who exactly modified shared files. I think it could be extracted somehow from permissions mechanism in Windows, but how? Have you got any ideas how to get at least login of the person who accessed and modified shared content? I can use either C# or PowerShell.

Answer 1

The best way to do this is to enable advanced file auditing on the servers you need this information on. If that isn't an option (it can get quite inefficient on servers with high disk IO), you can try using FileSystemWatcher to get the same results. Here is an example of how to do that!