Getting Data In

Reporting what user changes files

Splunk Employee
Splunk Employee

I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks.

0 Karma
1 Solution

Motivator

Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk.

See http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913 for more information.

View solution in original post

Motivator

Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk.

See http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913 for more information.

View solution in original post