ReadDirectoryChangesW 并确定哪个进程导致了更改
如何确定哪些进程正在对哪些文件进行更改。
我确实找到了这个：
FileSystemWatcher：如何知道哪个进程做了改变？
但我很好奇最近有什么改变吗？是否可以使用 ReadDirectoryChangesW 或其他方式确定哪个进程正在对文件系统进行更改？我不想编写或使用内核驱动程序。
How can I determine which processes are making changes to which files.
I did find this:
FileSystemWatcher: how to know which process made the change?
But I'm curious if anything has changed lately? Is it possible yet to determine which process is making changes to the file system, either using ReadDirectoryChangesW or anything else? I'd prefer not to have to write or use a kernel driver.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
对要跟踪的文件创建安全审核。该信息将记录在安全事件日志中。
Create a security audit on the files you want to track. The information will be recorded in the security event log.
虽然可以找到使用内核驱动程序更改文件的进程（例如，进程监视器），如果文件夹在网络上共享，并且另一台计算机上的进程通过网络修改文件，则识别进程时总会出现问题。
在这种情况下，即使是内核驱动程序也会将网络共享进程识别为访问文件的进程，而不是另一台计算机上的进程。
While it may be possible to find out the process that changes a file using kernel drivers (for example, process monitor), there will always be a problem identifying the process in case the folder is shared on the network, and a process on another computer modifies the file over the network.
Even the kernel drivers would in this case identify the network share process as the one accessing the file, not the process on the other computer.
我似乎还不能发表评论。我对您在文件或路径上创建安全审核的 Python 代码感兴趣。如果它扰乱了系统安全事件日志，那就有点可惜了，但你不可能拥有一切！ :-)
到目前为止，我在更改时一直使用 GetForegroundWindow 来最终获取关联的进程。它只适用于用户发起的更改，但这主要是我感兴趣的。除了后台进程之外，唯一的小问题是有时会生成一个进程只是为了完成任务（如批处理文件）并且当您想了解更多信息时（例如产生它的进程），它已经不存在了。不过，我想即使进行了安全审核，这也是一个问题。
I can't seem to comment yet. I would be interested in your Python code that creates a security audit on files or paths. It's a bit of a shame if it messes with the system security event log, but you can't have everything! :-)
Up until this point, I have been using GetForegroundWindow at the time of the change to eventually get the associated process. It only works well for changes initiated by the user, but that is primarily what I've been interested in. Besides background processes, the only minor issue is that sometimes a process is spawned just to accomplish a task (like a batch file) and it is non-existent by the time you want to learn more about it (like what process spawned it). I imagine that is a problem even with a security audit, though.