Is there any way to tell who renamed a folder using the FileSystemWatcher (Or other method)? RRS feed

  • Question

  • Hi all,


    I am looking for a way to capture the following in C#:

    1.  When a folder is renamed

    2.  What the original folder name was

    3.  Who renamed that folder


    I was able to capture 1 and 2 using the FileSystemWatcher class, but I am coming up short on 3:  The Who.  I implemented the NetFileEnum class in the NetAPI32 to see if I could get a username from that, but the folder is not considered to be "Open" until explorer actually views the contents of the folder.  Most of the renames that I am looking for are accidental renames, so the user never actually opens the folder, they just rename it, and continue on there business like they never did.  Any ideas??


    My only other thought was in doing some reading, you can turn on File/Folder auditing in Active directory and then I guess I could monitor the event log for Auditing, but I am not familiar with AD and would like to find a solution that wouldn't require that to be enabled.


    Thanks in advance!



    Friday, February 29, 2008 8:15 PM


  • Regarding #1 and #2:


    The FileSystemWatcher.Renamed event raises with a RenamedEventArgs that contains OldName / OldFullPath properties in addition to Name / FullPath (which are the new values).


    You should be able to use the following to test if this is a directory instead of a file:


    Code Snippet

    if ((System.IO.File.GetAttributes(e.FullPath)

      & System.IO.FileAttributes.Directory)

      == System.IO.FileAttributes.Directory)


    // Directory



    Regarding #3:


    This doesn't seem to be something that the OS tracks (other than of course through the audit system).


    Saturday, March 1, 2008 12:07 AM