c# - 以编程方式确定上次在 Windows 上修改文件的用户？

Question

我的任务是用 C# 编写一个简单的命令行实用程序，它将监视服务器上的一个目录，多个用户将访问该目录以复制/剪切/粘贴/查看数据。我用了FileSystemWatcher要做到这一点，但它缺少一些功能。

是否可以确定访问/修改文件的用户或至少是计算机名？

(注意:这不一定要与 FileSystemWatcher 一起使用，我正在寻找任何方法来做到这一点。)

Answer 1

我认为您不能直接从 C# 中监控它。无论如何，都离不开主机操作系统的帮助。 Windows 和 NTFS 允许您审核特定目录并将访问记录在主机的安全事件日志中(因此托管共享的服务器必须审核，而不是客户端)。

来自 KB310399 - How to audit user access of files, folders, and printers in Windows XP

Auditing User Access of Files, Folders, and Printers

The audit log appears in the Security log in Event Viewer. To enable this feature:

1. Click Start, click Control Panel, click Performance and Maintenance, and then click Administrative Tools.
2. Double-click Local Security Policy.
3. In the left pane, double-click Local Policies to expand it.
4. In the left pane, click Audit Policy to display the individual policy settings in the right pane.
5. Double-click Audit object access.
6. To audit successful access of specified files, folders and printers, select the Success check box.
7. To audit unsuccessful access to these objects, select the Failure check box.
8. To enable auditing of both, select both check boxes.
9. Click OK.

Specifying Files, Folders, and Printers to Audit

After you enable auditing, you can specify the files, folders, and printers that you want audited. To do so:

1. In Windows Explorer, locate the file or folder you want to audit. To audit a printer, locate it by clicking Start, and then clicking Printers and Faxes.
2. Right-click the file, folder, or printer that you want to audit, and then click Properties.
3. Click the Security tab, and then click Advanced.
4. Click the Auditing tab, and then click Add.
5. In the Enter the object name to select box, type the name of the user or group whose access you want to audit. You can browse the computer for names by clicking Advanced, and then clicking Find Now in the Select User or Group dialog box.
6. Click OK.
7. Select the Successful or Failed check boxes for the actions you want to audit, and then click OK.
8. Click OK, and then click OK.

服务器操作系统和 Windows Vista/Windows 7 的过程类似。如果你走这条路，你可以让 C# 程序读取事件日志(参见 EventLog 类)以查找你想要的数据。

注意:从 vista 开始，您必须是(如果需要，UAC 提升)管理员才能从代码中读取它们。