Checking who edited my file

Question

There is file named status.html which is used as a loadbalancer between WFE's on SharePoint servers. My query is I want to come up with a script or a mechanism that will trigger a mail as soon as this file is edited by someone. Is it possible?

In my research I have found this script:

$ACL = new-object System.Security.AccessControl.DirectorySecurity
$AccessRule = new-object System.Security.AccessControl.FileSystemAuditRule("domain\seitconsult","Modify","success")
$ACL.SetAuditRule($AccessRule)
$ACL | Set-Acl "C:\windows\system32\cmd.exe"

But I'm not sure if that will work. Also, how can trigger an email using this script?

score 0 · Answer 1 · edited May 23 '17 at 10:27

I see two ways to achieve your goal:

Attach a "send an e-mail" task to the event in question:
1. Open the Event Viewer (eventvwr.msc) and select an event you want to be notified about.
2. Click Action → Attach Task To This Event…
3. Step through the wizard and select Send an e-mail in the Action section.
4. Fill in the details and finish the wizard.
See here for more information.

Set up a FileSystemWatcher:

$folder = 'C:\your\html\folder'
$file   = 'status.html'

$from    = 'monitor@example.com'
$to      = 'you@example.com'
$subject = "$file was modified"

$monitor = New-Object IO.FileSystemWatcher $folder, $file -Property @{
  IncludeSubdirectories = $false
  NotifyFilter = [IO.NotifyFilters]'FileName, LastWrite'
}

Register-ObjectEvent $monitor Changed -SourceIdentifier FileChanged -Action {
  $name   = $Event.SourceEventArgs.FullPath
  $reader = New-Object System.IO.StreamReader($name)
  $msg    = $reader.ReadToEnd()
  Send-MailMessage -From $from -To $to -Subject $subject -Body $msg
  $reader.Close()
}

However, since the NotifyFilters don't include the username you need to extract that from the respective audit event in the eventlog as described here.

The watcher can be removed via its source identifier:

Unregister-Event -SourceIdentifier FileChanged

Thank you very much for your comments. The C# code that you have referred to, can your please let me know how can i run it? I mean on the servers where I will implement that doesn't have C# compiler. Also, will the above power shell code generate an event in event viewer? Please provide your comments. — Lilly123, Oct 26 '15 at 09:02
@Lilly123 You'll need to translate the C# code to PowerShell (use `Get-EventLog`). And no, the above code won't generate eventlog entries. If you enable auditing (which you'll need to do in order to get the information who modified the file) that will already create eventlog records. — Ansgar Wiechers, Oct 26 '15 at 10:37

Checking who edited my file

1 Answers1