Solved: Re: Reporting what user changes files

Jaci · ‎10-13-2010

I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks.

ftk · ‎10-13-2010

Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk.

See http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913 for more information.

View solution in original post

ftk · ‎10-13-2010

Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk.

See http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913 for more information.

Reporting what user changes files

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Make Your Machine Data AI-Ready in Splunk

How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

Join the Conversation