Reporting what user changes files

[Jaci]

I am using fschange to monitor a Windows shared directory and it is working as expected. Is there a way to report/monitor what user made the changes? Thanks.

[ftk · Accepted solution]

Fschange does not record the login making the changes on Windows. You can however use OS native auditing and report on it via Splunk.

See http://answers.splunk.com/questions/7903/fschange-hashing-question/7913#7913 for more information.