Find out WHO made the last change to files by Powershell?

windows powershell acl
Root Loop picture Root Loop · Apr 7, 2015 · Viewed 8.9k times · Source

I have a shared network location for all users saving files. All users have full access to this location.

Is that possible to find out WHO made the last change to a file or folder by Powershell or any other way?

There is no issue to get all those date and owner info from Powershell, but looks like there is no way to find out WHO made the last changes.

any idea please?

Answer

Richard picture Richard · Apr 7, 2015

The only user held against a file on NTFS is the owner. There is no record of who last modified the file.

However Windows can audit file system operations.

See http://support.microsoft.com/en-us/kb/310399 (says Windows XP in the title but applies to later versions). This needs to be applied to the system hosting the file system.

Related questions

Removing all ACL on folder with powershell

I'm pretty new to powershell scripting (nearly 1 month since I started learning powershell.) I'm currently working on a script with powershell 2.0 to clean folder NTFS ACL. I want to delete every acl except the administrator one. My problem is that …

Read More
Run command as System User in Powershell

I found several answers on the web, but not really what I was searching for. The issue is as follows: When restoring a file with "Networker", the ACLs of the file are the same ones as when the file was …

Read More
How to set permission on folder using powershell

i am trying to write a script which adds"CreatorOwner" permission to profile$ folders on all file servers; i.e , add "CreatorOwner" permissions to "\FileServer\Profile$" can anybody tell me whats the command and syntax for it? Please do ask …

Read More