How do I get the username for the user deleted a file in a folder

Question

2.00/5 (1 vote)

See more:

I need to get the username of the user who deleted a file in folder.
I tried the file system watcher but it does not provide the username.
Can anyone help?

Posted 11-Feb-14 16:35pm

Mohammad Al Hoss

Add a Solution

Comments

Sergey Alexandrovich Kryukov 11-Feb-14 22:45pm

Why? why?!
—SA

3 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Dave Kreskowiak · Answer 1 · 2014-02-11T16:50:00

The filesystem does not track who deletes a file.

The only thing you can use to determine this requires that you have Auditing turned on on the server. You can then scan the Security log (Admin permissions required!) to find the Delete entry and the account that did it. Warning! Turning on auditing on too much stuff will generate LOTS and LOTS of entries in the Security log, possibly making it take an inconveniently long time to find the log entry.

Sergey Alexandrovich Kryukov · Answer 2 · 2014-02-11T16:45:00

Hardly. File systems, per se, in certain sense, are totally agnostic to the user accounts.

You may argue say that they preserve the permission records indicating what user is authorized to do what. That's true, but won't generally help you. Or, if you will, it can be your last chance. Suppose that only one user had access to some file, so only that user can be blamed for deleting it. However, such cases are rare. It could also be another user, say, with administrative privileges, who could use elevated privilege execution to delete the same file. And many files have access rights shared by more then one user, say, by the whole group. Then — and that would be majority of cases — you have no chance to detect who did it.

And why? Isn't it better to prevent accidents by consistent administration, backup and educating users. What would be your purpose? Just to blame someone? Would be too late.

—SA

Snehasish_Nandy · Answer 3 · 2014-02-11T16:42:00

Solution 1

Have a look at this

how-can-i-get-user-who-deleted-file[^]

Posted 11-Feb-14 16:42pm

Snehasish_Nandy

Comments

Sergey Alexandrovich Kryukov 11-Feb-14 22:47pm

It does not solve the problem posed by OP, who already tried the FileSystemWatcher. The real approach would be: not solving this problem at all, it would be pretty much pointless.
—SA

How do I get the username for the user deleted a file in a folder

3 solutions

Solution 3

Solution 2

Solution 1

Add your solution here

Preview 0