如何获取用户删除文件夹中文件的用户名 [英] How do I get the username for the user deleted a file in a folder

问题描述

我需要获取删除文件夹中文件的用户的用户名。

我尝试过文件系统观察程序，但它没有提供用户名。

可以谁帮忙？

I need to get the username of the user who deleted a file in folder.
I tried the file system watcher but it does not provide the username.
Can anyone help?

推荐答案

文件系统不会跟踪谁删除文件。



唯一的你可用于确定这需要您在服务器上启用审核。然后，您可以扫描安全日志（需要管理员权限！）以查找删除条目和执行此操作的帐户。警告！打开太多东西的审计将在安全日志中生成很多条目，可能会花费很长时间来查找日志条目。

The filesystem does not track who deletes a file.

The only thing you can use to determine this requires that you have Auditing turned on on the server. You can then scan the Security log (Admin permissions required!) to find the Delete entry and the account that did it. Warning! Turning on auditing on too much stuff will generate LOTS and LOTS of entries in the Security log, possibly making it take an inconveniently long time to find the log entry.

很难。在某种意义上，文件系统本身对用户帐户是完全不可知的。



您可能会争辩说他们保留了许可记录，表明哪些用户被授权做什么。这是真的，但通常不会帮助你。或者，如果你愿意，这可能是你最后的机会。假设只有一个用户可以访问某个文件，因此只有该用户可以被指责删除它。但是，这种情况很少见。它也可能是另一个用户，例如，具有管理权限，可以使用提升的权限执行来删除同一个文件。并且许多文件具有由多个用户共享的访问权限，例如整个组。然后 - 这将是大多数情况 - 你没有机会发现是谁做的。



为什么？通过一致的管理，备份和教育用户来预防事故是不是更好。你的目的是什么？只是怪某人？为时已晚。

-SA

Hardly. File systems, per se, in certain sense, are totally agnostic to the user accounts.

You may argue say that they preserve the permission records indicating what user is authorized to do what. That's true, but won't generally help you. Or, if you will, it can be your last chance. Suppose that only one user had access to some file, so only that user can be blamed for deleting it. However, such cases are rare. It could also be another user, say, with administrative privileges, who could use elevated privilege execution to delete the same file. And many files have access rights shared by more then one user, say, by the whole group. Then — and that would be majority of cases — you have no chance to detect who did it.

And why? Isn't it better to prevent accidents by consistent administration, backup and educating users. What would be your purpose? Just to blame someone? Would be too late.

—SA

看看这个



怎么做 - i-get-user-who-deleted-file [ ^ ]

这篇关于如何获取用户删除文件夹中文件的用户名的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！