can record unc connection?

Question

The Pc I use have an UNC file. I'm in a Network with other people. Every other can open the file by tipping in the adress line \\file.

Know I want to write a c# programm in Vs2010 which watch over the file I use Win7 32bit. If any one Open the file the programm shall write in a Logfile that someone has open my file.

I tried to use the FileSystemWatcher but this only look for changes/saves/cration but not for Opening.

I read somthing about "auditing" and that I'm be able to do that(watch over my unc file) with this(auditing).But i tried to find out how to use auditing in c# but i found not much.

.

So my Questions:

Is it possible to do what i want with "auditing" ?

Did someone worked with auditing in c# befor or has anyone a link or somtihng to show me how it works in c#?

mfg Sam

Sry for bad english

Answer 1

You might want to use the Audit Object Access.

The steps you have to follow:

1. Enable the Audit object access in the Local Computer Policy.
2. Enable auditing for the object you want to follow.
3. From your application, use the EventLog.EntryWritten Event to detect the file opening event

Here's a simplistic sample usage, but you'll have to dig in the documentation in order to capture and log as you need to:

class Program
{
    public static void Main()
    {

        EventLog myNewLog = new EventLog("Security", ".", "Microsoft Windows security");

        myNewLog.EntryWritten += new EntryWrittenEventHandler(MyOnEntryWritten);
        myNewLog.EnableRaisingEvents = true;

        Console.ReadLine();
    }

    public static async void MyOnEntryWritten(object source, EntryWrittenEventArgs e)
    {
        await Task.Factory.StartNew(() =>
        {
            if (e.Entry.InstanceId == 4656 || e.Entry.InstanceId == 4663)
            {
                Console.WriteLine(e.Entry.Message);
            }
        });
    }
}