https://community.splunk.com/t5/Getting-Data-In/Reporting-what-user-changes-files/m-p/69805#M14189 <P>I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks.</P> Thu, 14 Oct 2010 01:10:14 GMT Jaci 2010-10-14T01:10:14Z https://community.splunk.com/t5/Getting-Data-In/Reporting-what-user-changes-files/m-p/69805#M14189 <P>I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks.</P> Thu, 14 Oct 2010 01:10:14 GMT https://community.splunk.com/t5/Getting-Data-In/Reporting-what-user-changes-files/m-p/69805#M14189 Jaci 2010-10-14T01:10:14Z https://community.splunk.com/t5/Getting-Data-In/Reporting-what-user-changes-files/m-p/69806#M14190 <P>Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk.</P> <P>See <A href="http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913" rel="nofollow">http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913</A> for more information.</P> Thu, 14 Oct 2010 01:22:58 GMT https://community.splunk.com/t5/Getting-Data-In/Reporting-what-user-changes-files/m-p/69806#M14190 ftk 2010-10-14T01:22:58Z