|
I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks. |
|
Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk. See http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913 for more information. |
