Refine your search:

I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks.

asked 13 Oct '10, 18:10

Jaci's gravatar image

Jaci ♦
8722217
accept rate: 75%


One Answer:

Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk.

See http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913 for more information.

link

answered 13 Oct '10, 18:22

ftk's gravatar image

ftk ♦
6.2k419
accept rate: 37%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×100
×53

Asked: 13 Oct '10, 18:10

Seen: 293 times

Last updated: 13 Oct '10, 18:22

Copyright © 2005-2012 Splunk, Inc. All rights reserved.