none
How to know which client connected to the server made changes to the Shared Folder RRS feed

  • Question

  • I am using Windows Server 2012 R2. There is a shared folder on the server with name PublicFolder. There is an application which runs on server as well as on standalone reporting clients. These standalone clients are running on Windows 7 which are connected to the server. Whatever changes a client makes are updated in a xml file in this PublicFolder on the server. But, the client details remain missing who made these changes. I want to know which client made these changes on the reporting client that gets updated in the server (basically the hostname of reporting client). On each client, multiple users can also log in. How to track the users too?
    I tried auditing, but it gives no good information. It shows the server's Administrator name in Account Name and not the client name.

    Please help me in finding which user on which client (hostname) is creating, deleting or modifying something on the application which gets updated in the PublicFolder on Server!

    Friday, November 24, 2017 4:42 AM

All replies

  • @JamesCole85 As I mentioned earlier, I have already performed these steps (auditing) but does not provide the information I am looking for.
    I want to know about the user and the client from which these changes were made 
    • Edited by Kuku5 Friday, November 24, 2017 4:50 AM
    Friday, November 24, 2017 4:50 AM
  • Hi Kuku5,

    Based on my knowledge,for the build-in feature,we could only use audit policy to monitor who do the operation for the file/folders.

    http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/

    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/

    I'm afraid couldnot show more details about which client the user log on do the operation. Could only check the user account.

    Appreciate your support and understanding.

    Best Regards,

    Mary


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Friday, November 24, 2017 6:27 AM
    Moderator
  • Hi,

    Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.

    Best Regards,

    Mary


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, November 27, 2017 9:04 AM
    Moderator
  • Auditing did not help me. It just monitors the shared folder for any changes made. It does not tell about the user who made this change
    Monday, December 4, 2017 4:44 AM
  • I implemented monitoring of directory and files using C#. It only monitors events like Created, Renamed, Changed, Deleted and Error events. 

    But, I also need help with monitoring the hostname/IP address of the computer accessing the shared folder.

    Here is my code :

    using System;
    using System.Collections.Generic;
    using System.ComponentModel;
    using System.Data;
    using System.Drawing;
    using System.Linq;
    using System.Text;
    using System.Windows.Forms;
    using System.IO;
    using System.Threading;
    namespace a1ashiishFileSystemWatcher
    {
        public partial class MainForm : Form
        {
            public ListBoxlistBox;
            public const String startMonitoring = “Start Minitoring…”;
            public const String stopMonitoring = “Stop Minitoring…”;
            public MainForm()
            {
                InitializeComponent();
                //Create a listBox to show activities of all Events.
                listBox = new ListBox();
                listBox.FormattingEnabled = true;
                listBox.Location = new System.Drawing.Point(23, 121);
                listBox.Name = “listBox”;
                listBox.Size = new System.Drawing.Size(571, 238);
                listBox.TabIndex = 2;
                this.Controls.Add(listBox);
            }
            private voidbutton1_Click(object sender, EventArgs e)
            {
                // Create FolderBrowserDialog object.
                FolderBrowserDialog folderBrowserDialog = new FolderBrowserDialog();
                // Show a button to create a new folder.
                folderBrowserDialog.ShowNewFolderButton = true;
                DialogResult dialogResult = folderBrowserDialog.ShowDialog();
                // Get selected path from FolderBrowserDialog control.
                if (dialogResult == DialogResult.OK)
                {
                    textBox1.Text = folderBrowserDialog.SelectedPath;
                    Environment.SpecialFolderroot = folderBrowserDialog.RootFolder;
                }
            }
            private voidbutton2_Click(object sender, EventArgs e)
            {
                // Create a new FileSystemWatcher object.
                FileSystemWatcher fsWatcher = new FileSystemWatcher();
                switch (button2.Text)
                {
                    // Start Monitoring…
                    case startMonitoring:
                        if (!textBox1.Text.Equals(String.Empty))
                        {
                            listBox.Items.Add(“Started FileSystemWatcher Service…”);
                            fsWatcher.Path = textBox1.Text;
                            // Set Filter.
                            fsWatcher.Filter = (textBox2.Text.Equals(String.Empty)) ? “*.*” : textBox2.Text;
                            // Monitor files and subdirectories.
                            fsWatcher.IncludeSubdirectories = true;
                            // Monitor all changes specified in the NotifyFilters.
                            fsWatcher.NotifyFilter = NotifyFilters.Attributes |
                                                     NotifyFilters.CreationTime |
                                                     NotifyFilters.DirectoryName |
                                                     NotifyFilters.FileName |
                                                     NotifyFilters.LastAccess |
                                                     NotifyFilters.LastWrite |
                                                     NotifyFilters.Security |
                                                     NotifyFilters.Size;
                            fsWatcher.EnableRaisingEvents = true;
                            // Raise Event handlers.
                            fsWatcher.Changed += new FileSystemEventHandler(OnChanged);
                            fsWatcher.Created += new FileSystemEventHandler(OnCreated);
                            fsWatcher.Deleted += new FileSystemEventHandler(OnDeleted);
                            fsWatcher.Renamed += new RenamedEventHandler(OnRenamed);
                            fsWatcher.Error += new ErrorEventHandler(OnError);
                            button2.Text = stopMonitoring;
                            textBox1.Enabled = false;
                            textBox2.Enabled = false;
                        }
                        else
                        {
                            listBox.Items.Add(“Please select folder to monitor….”);
                        }
                        break;
                    // Stop Monitoring…
                    case stopMonitoring:
                    default:
                        fsWatcher.EnableRaisingEvents = false;
                        fsWatcher = null;
                        button2.Text = startMonitoring;
                        textBox1.Enabled = true;
                        textBox2.Enabled = true;
                        listBox.Items.Add(“Stopped FileSystemWatcher Service…”);
                        break;
                }
            }
            // FileSystemWatcher – OnCreated Event Handler
            public voidOnCreated(object sender, FileSystemEventArgs e)
            {
                // Add event details in listbox.
                this.Invoke((MethodInvoker)delegate { listBox.Items.Add(String.Format(“Path : “{0}”   || Action : {1}”, e.FullPath, e.ChangeType)); });
            }
            // FileSystemWatcher – OnChanged Event Handler
            public voidOnChanged(object sender, FileSystemEventArgs e)
            {
                // Add event details in listbox.
                this.Invoke((MethodInvoker)delegate { listBox.Items.Add(String.Format(“Path : “{0}”   || Action : {1}”, e.FullPath, e.ChangeType)); });
            }
            // FileSystemWatcher – OnRenamed Event Handler
            public voidOnRenamed(object sender, RenamedEventArgs e)
            {
                // Add event details in listbox.
                this.Invoke((MethodInvoker)delegate { listBox.Items.Add(String.Format(“Path : “{0}”   || Action : {1} to “{2}””, e.FullPath, e.ChangeType, e.Name)); });
            }
            // FileSystemWatcher – OnDeleted Event Handler
            public voidOnDeleted(object sender, FileSystemEventArgs e)
            {
                // Add event details in listbox.
                this.Invoke((MethodInvoker)delegate { listBox.Items.Add(String.Format(“Path : “{0}”   || Action : {1}”, e.FullPath, e.ChangeType)); });
            }
            // FileSystemWatcher – OnError Event Handler
            public void OnError(object sender, ErrorEventArgse)
            {
                // Add event details in listbox.
                this.Invoke((MethodInvoker)delegate { listBox.Items.Add(String.Format(“Error : {0}”, e.GetException().Message)); });
            }
        }
    }


    Monday, December 4, 2017 6:02 AM
  • Hi Kuku5,

    Thanks for sharing your scripts for anyone else to do a reference.

    I'm afraid for more professional support about monitoring the hostname/IP address may still need to try with scripts, and for this part, you could also discuss in Our Scripts forum.

    https://social.technet.microsoft.com/Forums/scriptcenter/en-us/home?category=scripting

    Appreciate your support and understanding.

    Best Regards,

    Mary


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, December 4, 2017 9:01 AM
    Moderator
  • I have tried this approach, but still I am not able to get the hostname. Please help me where I am going wrong.

    using System;
    using System.Collections.Generic;
    using System.ComponentModel;
    using System.Data;
    using System.Diagnostics;
    using System.Linq;
    using System.ServiceProcess;
    using System.Text;
    using System.Threading.Tasks;
    using System.IO;
    
    namespace MonitorShare
    {
        public partial class Monitor : ServiceBase
        {
            public Monitor()
            {
                InitializeComponent();
                string dDirectory = @"E:\SharedFolder\Shares";
                DirectoryInfo info = new DirectoryInfo(dDirectory);
                string[] filePath = Directory.GetFiles(dDirectory, "*.*");
    
                FileSystemWatcher watcher = new FileSystemWatcher();
                watcher.BeginInit();
                watcher.filePath = dDirectory;
                watcher.NotifyFilter = NotifyFilters.LastAccess | NotifyFilters.LastWrite | 
    
    NotifyFilters.FileName | NotifyFilters.DirectoryName;
                watcher.Changed += new FileSystemEventHandler(watcher_Changed);
                watcher.Created += new FileSystemEventHandler(watcher_Created);
                watcher.Deleted += new FileSystemEventHandler(watcher_Deleted);
                watcher.Filter = "*.*";
                watcher.EnableRaisingEvents = true;
                watcher.EndInit();
            }
    
            protected void watcher_Deleted(object sender, FileSystemEventArgs e)
            {
                var process = new Process();
                process.StartInfo.FileName = "openfiles.exe";
                process.StartInfo.Arguments = "/query /FO CSV /v";
                process.StartInfo.UseShellExecute = false;
                process.StartInfo.CreateNoWindow = true;
                process.StartInfo.RedirectStandardOutput = true;
                try
                {
                    process.Start();
                    if ((process.StandardOutput != null))
                    {
                        var result = process.StandardOutput.ReadToEnd().Trim().Replace("\"", 
    
    "");
                        var lines = result.Split('\n');
    
                        var firstLineIndex = 1 + lines.Cast<string>().ToList().FindIndex(l => 
    
    l.Contains("Hostname"));
                        for (var i = firstLineIndex; i < lines.Count() && firstLineIndex > 0; i
    
    ++)
                        {
                            var fields = lines[i].Split(',');
                            var time = DateTime.Now;
                            FileStream fs = new FileStream(@"C:\SFD\log.txt", FileMode.Append);
                            StreamWriter sw = new StreamWriter(fs);
                            
                            if(firstLineIndex.ToString()=="Hostname")
                            {
                                 Console.SetOut(sw);
                                 Console.WriteLine(e.FullPath + "\t" + e.ChangeType + "\t" + 
    
    time + "\t" + e.Name + "\t" + fields[0]);
                                 sw.Close();
                            }
                        }
                    }
                    process.WaitForExit();
                }
                catch (Exception ex)
                {
                   
                }
                finally
                {
                    process.Close();
                }
            }
    
            protected void watcher_Created(object sender, FileSystemEventArgs e)
            {
                var process = new Process();
                process.StartInfo.FileName = "openfiles.exe";
                process.StartInfo.Arguments = "/query /FO CSV /v";
                process.StartInfo.UseShellExecute = false;
                process.StartInfo.CreateNoWindow = true;
                process.StartInfo.RedirectStandardOutput = true;
                try
                {
                    process.Start();
                    if ((process.StandardOutput != null))
                    {
                        var result = process.StandardOutput.ReadToEnd().Trim().Replace("\"", 
    
    "");
                        var lines = result.Split('\n');
    
                        var firstLineIndex = 1 + lines.Cast<string>().ToList().FindIndex(l => 
    
    l.Contains("Hostname"));
                        for (var i = firstLineIndex; i < lines.Count() && firstLineIndex > 0; i
    
    ++)
                        {
                            var fields = lines[i].Split(',');
                            var time = DateTime.Now;
                            FileStream fs = new FileStream(@"C:\SFD\log.txt", FileMode.Append);
                            StreamWriter sw = new StreamWriter(fs);
                            
                            if(firstLineIndex.ToString()=="Hostname")
                            {
                                 Console.SetOut(sw);
                                 Console.WriteLine(e.FullPath + "\t" + e.ChangeType + "\t" + 
    
    time + "\t" + e.Name + "\t" + fields[0]);
                                 sw.Close();
                            }
                        }
                    }
                    process.WaitForExit();
                }
                catch (Exception ex)
                {
                   
                }
                finally
                {
                    process.Close();
                }
             
            }
    
            protected override void OnStart(string[] args)
            {
            }
    
            protected override void OnStop()
            {
            }
        }
    }
    

    Tuesday, December 12, 2017 9:43 AM
  • Hi,

    As suggested before, you could consider to discuss in Our Scripts forum for more professional support about scripts.

    https://social.technet.microsoft.com/Forums/scriptcenter/en-us/home?category=scripting

    Appreciate your support and understanding.

    Best Regards,

    Mary


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, December 13, 2017 4:19 AM
    Moderator
  • @Mary Dong I asked for some suggestions on Scripts forum, but never got any good result
    • Edited by Kuku5 Wednesday, December 13, 2017 5:49 AM
    Wednesday, December 13, 2017 4:28 AM