Find out WHO made the last change to files by Powershell?

Question

I have a shared network location for all users saving files. All users have full access to this location.

Is that possible to find out WHO made the last change to a file or folder by Powershell or any other way?

There is no issue to get all those date and owner info from Powershell, but looks like there is no way to find out WHO made the last changes.

any idea please?

Richard Richard · Accepted Answer · 2015-04-07T13:16:44

The only user held against a file on NTFS is the owner. There is no record of who last modified the file.

However Windows can audit file system operations.

See http://support.microsoft.com/en-us/kb/310399 (says Windows XP in the title but applies to later versions). This needs to be applied to the system hosting the file system.