Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Can I detect which computer changed a file?

18 Feb 2013   #1

Windows 7
Can I detect which computer changed a file?

Hello, we use a small network with all the same username on each computer. I want to be able to look at a saved file and find out who made the change or who created the file.

Is there any possible way to do this based on the computer name or ip address of the computer who created/modified a file?

This is a somewhat rare need so I am fine with going through log files to find out.


My System SpecsSystem Spec
18 Feb 2013   #2

Windows 7/8/8.1 x64 &&& Debian-Based Linux

AFAIK, the only way you could determine this is by cross referencing the MACE timestamps with timestamps in Windows logs (uptime/logon) and router logs (MAC addresses and hostnames). If all your machines are generally always on and connected to the network, you may be out of luck.

The MACE timestamps are viewable through the properties menu, they are just the Modified, Accessed, and Created entries. This will tell you the time of creation and time of last modification.

After that you should collect the info on each machine's computer name/hostname (Right-click Computer > Properties > Advanced) and MAC addresss (command prompt: ipconfig /all).

The router will tell you when each computer requested an IP (if you're on a DHCP network) and this will tell you when each machine was online. If your network is not DHCP (the IP addresses are static) then you can record each machine's IP as well (Network and Sharing > Change Adapter Settings > Right-click adapter > Properties > IPv4 > Properties). If this dialog has Obtain IP address Automatically selected, then DHCP is enabled.

However, if your network is not internet-enabled, it may not have a router, and while DCHP may be enabled on your computers, your machines may obtain their addresses using APIPA. In this case I do not know that there will be any Windows event logs with this information.

I do not think there are any logs created upon file access, creation, or modification either, as these are noted in the file itself. It may be helpful to know where the file was stored and how it was acccessed. For instance, on my machines, Homegroup is disabled. When a user wants to access files on another machine, it must provide user and password credentials for the computer it wants to access. This creates an event log. I do not know how Homegroup handles these things, or if there would be any relevant logs in that case. If the file that was created/modified is on a network share drive, you may be out of luck.

I know this doesnt much help you now after-the-fact, but for future reference, you can use the group policy feature in conjunction with the event viewer's custom view editor to really keep a watch over your network. You can define what sorts of activities you want different groups of users to be able to perform, and tell the event viewer to collect specific sorts of logs on particular events to get a general highlight of what people have been up to.
My System SpecsSystem Spec
19 Feb 2013   #3

Windows 7

Hmm, too bad there is no simple or quicker solution. Thank you for the help.
My System SpecsSystem Spec


 Can I detect which computer changed a file?

Thread Tools

Similar help and support threads
Thread Forum
Programs shortcuts'icons changed when changed exe file icon appearance
Hi guys, so I have a little problem, I've downloaded FileTypesMan because I wanted to change the .exe files appearance on my computer. I did this using this program - all .exe file icons changed, however, with them changed ALL the shortcuts to all the programs that I have on my laptop - now they...
World Of Tanks replay file accidently changed to media file
i have accidentally changed my world of tanks replay file to a media file and in trying to fix the problem into an adobe file i an wondering how to change this file back to a world of tanks file so i can veiw and post my replays. if anyone can help me reply or email me the fix at...
File Extensions changed (doc/pdf/jpg/txt) *.*original file-ex*.cpjevac
I have a User that brought a computer to me. Mostly all the files within the user folders where changed. Example of a file. Should be (Birthday.jpg) is now (Birthday.jpg.cpjevac) I have deleted the extension .cpjevac from the name allowing it to change to .jpg file and when doing so the file...
Hardware & Devices
Detect Escape key with batch file
I want to separate the escape key in a batch file from all others. If I use "choice", all keys would have to be listed. "errorlevel" seems to return "0" for every key because "choice" is not used. thanks...
General Discussion
Changed a file Association and it changed everything to a link file
LIke an idiot I changed a associate file and it has turned everything into a lnk so I cant open any programs or anything at all any solutions would be greatly appre:cry:ciated
General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 16:05.
Twitter Facebook