After looking at a few different options I have, I’ve decided it’s necessary for my application to hook network-related file operations (talked about here Retrieve who created/modified/deleted a file). Anyways, I’ve been doing some research on how to get a solid and reliable hooking scheme in place. Basically, I need to be able to monitor my Windows 2008 server for create/read/write/delete requests on an SMB share, and deny them if needed. I know this can be done using a minifilter driver, but I’m looking for a quicker solution, if there is one. Does anyone know of a solution?
Oops! I managed to leave out a huge requirement in the original post. I also need to be able to track which username has created/deleted/modified files in one of the shares. For this reason, I believe that a file system filter is not what I’m looking for.
If you just want to monitor file changes happening within a directory, you can try this Obtaining Directory Change Notifications. Incase you want to .Net/C# way try this FileSystemWatcher.
But this will just notify about the changes, you will not be able to control the operation (allow or deny).
If you have to control the operation minifilter is the way.