每当从Windows 7中的共享文件夹中删除文件时发送电子邮件

Question

I am running a software on several computers at my workplace and the software can run different audio and video files stored on a shared folder in a central computer. The software runs on windows 7 and every person in my company can add or remove files from the shared folder, but this privilege puts the data at risk. I was thinking of creating an email alert to my self whenever a file is deleted. I have written a windows powershell script for sending me emails from smtp server but how can I hook it up to the event of file or folder deletion in a specific shared folder?

Answer 1

Honestly, if you want real time monitoring (I'm guessing you do since you're wanting an email alert sent to you when you detect file deletion), then the hardest part is going to be keeping the script running...

Anyway, the first two things you're going to need to do are 1) Enable the Audit Policy "Audit Object Access" on the server hosting the share 2) Enable auditing for the user/group you're monitoring

After that, you're going to want to use the Get-Eventlog cmdlet to search for event ID 4663 (you can also use event IDs 4656 and 4658 to correlate the event - they represent the opening and closing of a given file).

Anyway, after you've enabled auditing, use something like this get started:

Get-EventLog security | Where-Object {$_.EventID -eq 4663}

Oh, and to keep it running, you'll probably want to use a scheduled job.

Answer 2

Or you could use an IO.FileSystemWatcher object and register an event.

Grts.