如何确定谁更改了文件？
在 Windows 中，如何以编程方式确定最后更改或删除文件的用户帐户？
我知道设置对象访问审核可能是一个选项，但如果我使用它，我就会遇到尝试将审核日志条目与特定文件匹配的问题......听起来复杂而混乱！ 我想不出任何其他方法，那么有人对这种方法或任何替代方法有任何提示吗？
In Windows, how can I programmatically determine which user account last changed or deleted a file?
I know that setting up object access auditing may be an option, but if I use that I then have the problem of trying to match up audit log entries to specific files... sounds complex and messy! I can't think of any other way, so does anyone either have any tips for this approach or any alternatives?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以将问题分为两部分：
正如您提到的，在这两个部分 1 中，写入日志是通过审核的内置功能。 重新发明它会很困难，而且可能永远不会像内置功能那样好。
我将通过在这些文件上设置审核 ACL 来使用内置功能进行日志记录。 然后，我将集中精力提供一个良好的界面，该界面可以读取事件日志、过滤出相关事件并以适合用户且相关的方式呈现它们。
You can divide your problem into two parts:
Of those two part 1, writing to the log is a built in function through auditing as you mention. Reinventing that would be hard and probably never get as good as the builtin functionality.
I would use the built in functionality for logging by setting up an audit ACL on those files. Then I would focus my efforts on providing a good interface that reads the event log, filters out relevant events and presents them in a way that is suitable and relevant for your users.
您始终可以创建文件系统过滤器。 这可能有点矫枉过正，但这取决于您的目的。 您可以让它在启动时加载，并且它几乎位于每个文件访问的后面（病毒扫描程序通常使用它来扫描访问的文件）。
只需记录正在写入文件的应用程序的“所有者”即可。
另请参阅 MSDN 文档
You could always create a file system filter. This might be overkill, but it depends on your purposes. You can have it load at boot and it sits behind pretty much every file access (its what virus scanners usually use to scan files as they are accessed).
Simply need to log the "owner" of the application that is writing to the file.
Also see the MSDN documentation
据我所知，执行此操作的唯一方法是设置 FileSystemWatcher 并保持其运行。 哦，如果是通过网络驱动器，它可能会随机失去连接，因此最好每隔几个小时强制断开/重新连接一次，以确保它具有新的连接。
The only way I know of to do this is to set up a FileSystemWatcher and keep it running. Oh, and if it's across a network drive, it may randomly lose connection, so it may be good to force a disconnect/reconnect every few hours just to make sure it has a fresh connection.