Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Can I detect which computer changed a file?

18 Feb 2013   #1
xmrkite

Windows 7
 
 
Can I detect which computer changed a file?

Hello, we use a small network with all the same username on each computer. I want to be able to look at a saved file and find out who made the change or who created the file.

Is there any possible way to do this based on the computer name or ip address of the computer who created/modified a file?

This is a somewhat rare need so I am fine with going through log files to find out.

-Thanks


My System SpecsSystem Spec
.
18 Feb 2013   #2
MSchild

Windows 7/8/8.1 x64 &&& Debian-Based Linux
 
 

AFAIK, the only way you could determine this is by cross referencing the MACE timestamps with timestamps in Windows logs (uptime/logon) and router logs (MAC addresses and hostnames). If all your machines are generally always on and connected to the network, you may be out of luck.

The MACE timestamps are viewable through the properties menu, they are just the Modified, Accessed, and Created entries. This will tell you the time of creation and time of last modification.

After that you should collect the info on each machine's computer name/hostname (Right-click Computer > Properties > Advanced) and MAC addresss (command prompt: ipconfig /all).

The router will tell you when each computer requested an IP (if you're on a DHCP network) and this will tell you when each machine was online. If your network is not DHCP (the IP addresses are static) then you can record each machine's IP as well (Network and Sharing > Change Adapter Settings > Right-click adapter > Properties > IPv4 > Properties). If this dialog has Obtain IP address Automatically selected, then DHCP is enabled.

However, if your network is not internet-enabled, it may not have a router, and while DCHP may be enabled on your computers, your machines may obtain their addresses using APIPA. In this case I do not know that there will be any Windows event logs with this information.

I do not think there are any logs created upon file access, creation, or modification either, as these are noted in the file itself. It may be helpful to know where the file was stored and how it was acccessed. For instance, on my machines, Homegroup is disabled. When a user wants to access files on another machine, it must provide user and password credentials for the computer it wants to access. This creates an event log. I do not know how Homegroup handles these things, or if there would be any relevant logs in that case. If the file that was created/modified is on a network share drive, you may be out of luck.

I know this doesnt much help you now after-the-fact, but for future reference, you can use the group policy feature in conjunction with the event viewer's custom view editor to really keep a watch over your network. You can define what sorts of activities you want different groups of users to be able to perform, and tell the event viewer to collect specific sorts of logs on particular events to get a general highlight of what people have been up to.
My System SpecsSystem Spec
19 Feb 2013   #3
xmrkite

Windows 7
 
 

Hmm, too bad there is no simple or quicker solution. Thank you for the help.
My System SpecsSystem Spec
.

Reply

 Can I detect which computer changed a file?




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
File Extensions changed (doc/pdf/jpg/txt) *.*original file-ex*.cpjevac
I have a User that brought a computer to me. Mostly all the files within the user folders where changed. Example of a file. Should be (Birthday.jpg) is now (Birthday.jpg.cpjevac) I have deleted the extension .cpjevac from the name allowing it to change to .jpg file and when doing so the file...
Hardware & Devices
Read-Only File gets changed Why? How? Who?
Hi, I have a simple Text file an a PC. In the File Properties I set the Read-Only flag apply the settings & ok. When I now open it in the Editor, I con not change any character. Now after a Time I realized, that the file has changed somehow. 1) Why does this happen? How can this...
General Discussion
How do I detect a dual boot through a batch file
Here is my issue. I have employees installing dual booting on computers, effectively bypassing security software that is installed. Is there a batch I can run to detect this, and output the results to a file ( on the network of course ) or something of that nature? I need a way to circumvent...
Installation & Setup
Detect Escape key with batch file
I want to separate the escape key in a batch file from all others. If I use "choice", all keys would have to be listed. "errorlevel" seems to return "0" for every key because "choice" is not used. thanks...
General Discussion
.msi File Association Has Been Changed
Here's a weird one folks. My wife recently downloaded PCHealthDoc, and somehow or other it has changed the file association for .msi install files. That's fine, I know how to reassign it, but where exactly is the Windows Installer, and what's the name of the file? I've done some searches but can't...
General Discussion
Changed a file Association and it changed everything to a link file
LIke an idiot I changed a associate file and it has turned everything into a lnk so I cant open any programs or anything at all any solutions would be greatly appre:cry:ciated
General Discussion


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 13:28.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App