I have a simple trigger that monitors a folder when files get created or deleted and send an email with Job Name, File name, Folder Path and File.
I need to also know the username of who created or deleted the file. Not having much luck with that.

Ideas?

Thanks!

Mark

I have a simple trigger that monitors a folder when files get created or deleted and send an email with Job Name, File name, Folder Path and File.
I need to also know the username of who created or deleted the file. Not having much luck with that.

Ideas?

Thanks!

Mark

Hi Mark,

Do you mean VisualCron user? or windows user?

---

I am going to assume they must mean the windows user.

I actually have a task that does this exact thing.

You will need the trigger to be your folder/file creation then have a PowerShell task (there is no way to do this for a file deletion)

Here is the script
$Path = get-childitem "{TRIGGER(398894c7-a91d-4d6d-b47f-0883752f9a07|LastTrigger|File.Folder)}\{TRIGGER(398894c7-a91d-4d6d-b47f-0883752f9a07|LastTrigger|File.Result.Name)}" -recurse -force
Get-ChildItem $Path -force -Recurse | Select FullName | format-table -AutoSize
Get-ChildItem $Path -force -Recurse | Select CreationTime | format-table -AutoSize
Get-ChildItem $Path -force -Recurse | Select @{N="Owner";E={ (Get-Acl $_.FullName).Owner }} | format-table -AutoSize

The Trigger GUID would be replaced by your trigger for that job. Everything below should remain and is not computer or server or job or file specific

The result will look like this:


If you do not want the path and all of that from PS just take out the the two lines. It is really just this line that finds you the owner
Get-ChildItem $Path -force -Recurse | Select @{N="Owner";E={ (Get-Acl $_.FullName).Owner }} | format-table -AutoSize

The ""owner" is the creator BUT depending on how the file got their the owner may be "Administrators" or "SYSTEM' or something like that. I assume you took that into account already

After your PowerShell runs you can take the output and place it in your email

The only way I know to do a deletion reporting would be through the event viewer. You would have to have that tracked in event viewer then, when a file is removed VC looks to the EV and finds the Event ID 4660. Might be pretty tough to get this to work if multiple files are removed. Depending on the function of this server and how many shares you have and the number of files that go in and out, this might be a real chore to get it done.

Thanks a lot for your great suggestion Joey.

Are you still having issues with this or did Joeys suggestion help you, Mark?

---