I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks.
Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk.
See http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913 for more information.
View solution in original post
