如何找出谁使用 .NET 在 Windows 中创建了文件？
我需要找出谁使用 .NET 创建了一个文件
我已经尝试过以下操作：
string FileLocation = @"C:\test.txt";
FileInfo droppedFile = new FileInfo(FileLocation);
FileSecurity fileSecurity = droppedFile.GetAccessControl();
IdentityReference identityReference = fileSecurity.GetOwner(typeof(NTAccount));
string userName = identityReference.Value;
Console.WriteLine(userName);
所有这些返回都是“BUILTIN\Administrators”
我在这里做错了什么吗？因为当我在资源管理器中查看 C:\ 时，所有者显示了正确的用户名，当我执行上面的代码时，它返回“BUILTIN\Administrators”，
这甚至不是域和用户名，我认为它是一个安全组。
任何帮助表示赞赏。
I need to find out who created a file using .NET
I have already tried the following:
string FileLocation = @"C:\test.txt";
FileInfo droppedFile = new FileInfo(FileLocation);
FileSecurity fileSecurity = droppedFile.GetAccessControl();
IdentityReference identityReference = fileSecurity.GetOwner(typeof(NTAccount));
string userName = identityReference.Value;
Console.WriteLine(userName);
All this returns is "BUILTIN\Administrators"
Am I doing something wrong here? Because when I look at the C:\ in explorer, the owner shows the correct username, when I exectute the code above it returns "BUILTIN\Administrators"
Which isn't even a domain and username, I think it's a security group.
Any help appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果用户是管理员，则他们创建的文件被视为由整个管理员组而不是单个用户拥有。
您可以在资源管理器的属性对话框中看到相同的行为。令人烦恼的是，除了不让用户成为管理员之外，我认为没有任何解决方法。
编辑：这篇 Technet 文章解释了此行为更详细地说。其基本原理是 Windows 将所有管理员视为一个实体；系统上的任何管理员都可以执行其他管理员可以执行的任何操作。
If a user is an administrator, then the files they created are considered to be owned by the whole administrators group, not the individual user.
You can see the same behaviour in Explorer's properties dialog. Annoyingly, I don't think there is any workaround, other than not making users admins.
Edit: This Technet article explains this behaviour in more detail. The rationale is that Windows treats all administrators as a single entity; any administrator on the system can do anything that the other administrators can.
更新：我错了，文件对象有一个所有者描述符！ （我的头在哪里）。请查看这篇 MSDN 文章。
可能是因为文件对象没有定义创建者或所有者，而是由系统本身（内置\管理员）拥有。 “组或用户名”列表仅指定有权访问该文件的组和用户的列表，而不是具体指定创建者。
您能做的最好的事情就是遍历“组或用户名”列表，并最好地猜测哪一个是创建者。
Update: I am wrong, there is an owner descriptor for file objects! (where was my head). Have a look at this MSDN article.
Possibly because the file object does not define a creator or owner, but instead is owned by the system itself (builtin\administrators). The "group or user names" list only specifies a list of groups and users that have access to the file, but not a creator specifically.
Best you can do is iterate through the list of "group or user names" and take a best guess which one the creator.