Question

In Windows, how can I programmatically determine which user account last changed or deleted a file?

I know that setting up object access auditing may be an option, but if I use that I then have the problem of trying to match up audit log entries to specific files… sounds complex and messy! I can’t think of any other way, so does anyone either have any tips for this approach or any alternatives?

Answer 1

You can divide your problem into two parts:

1. Write to a log whenever a file is accessed.
2. Parse, filter and present the relevant information of the log.

Of those two part 1, writing to the log is a built in function through auditing as you mention. Reinventing that would be hard and probably never get as good as the builtin functionality.

I would use the built in functionality for logging by setting up an audit ACL on those files. Then I would focus my efforts on providing a good interface that reads the event log, filters out relevant events and presents them in a way that is suitable and relevant for your users.