how to run event code when a server folder is renamed or deleted

I want to monitor a server folder so that changes to a sub-folder are passed to small audit program.  The goal is to warn the users before they make a change.

' something like this
Sub folderchange(oldFolder As Object, newFolder As Object, cancel As Boolean)
    If LCase(oldFolderParent.Foldername) Like "*special*" Then
        If MsgBox("are you sure you want to change " & oldFolder.ParentFoldername, vbYesNo + vbDefaultButton2)  <> vbYes Then
            cancel = True
        End If
    End If
End Sub

Open in new window


I have done some event programming in Outlook, Excel and MS Access, but I don't know how to do it for a file system object.

Perhaps I could put a vbscript program into the users daily logon ??? But other approaches  are welcome --  I don't care if the script runs on the server or the client CPU just whichever is easiest.

My environment is an SBS 2003 server with Windows 7 pro clients.  (Please -- no lectures about unsupported server software ;-)
LVL 5
rberkeConsultantAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

it_saigeDeveloperCommented:
First you would need to setup auditing for the File(s)/Folder(s):

Step-By-Step: How to audit file and folder access to improve Windows 2000 Pro security

Then you will want to create a task on your clients that runs a script or displays a message or some other such action when the client actions cause the event to be triggered:

Attaching Tasks to Event Viewer Logs and Events

-saige-
0
rberkeConsultantAuthor Commented:
Does anybody here have experience with Power Shell FileSystemWatcher? I think that might be more appropriate for my needs.

Our "level 0 special root directory" has 200 level 1 folders and MANY more lower level folders and files (over 200,000).  I only want to watch the 200 level 1 folders which are hardly ever changed.

Saige - The audit approach outlined in your "step-by-step" link contains warnings which seems to be directed directly at me.

Auditing object access
You must be careful which objects you audit or you will end up with the information overload problems.

 It's very easy to end up with information overload because if you audit a folder, the audit applies to every object within the folder and within any subfolders. The audit applies to child objects, grandchild objects, and so on. So when possible, I recommend auditing objects at the file leve
l.

I think my 200,000 files get so much daily activity that the audit approach would be inefficient.
0
it_saigeDeveloperCommented:
This link contains a PowerShell FileSystemWatcher implementation (no guarantees that it will work on Windows Server 2003) - https://gallery.technet.microsoft.com/scriptcenter/Powershell-FileSystemWatche-dfd7084b

-saige-
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
rberkeConsultantAuthor Commented:
the following code does a pretty good job but it is not perfect.

The main problem is that the filewatcher is only activated AFTER the folder is changed.  If the folder is renamed, my script could rename it back to the original.  But, I have no idea what to do if the folder is deleted.
 
I don't have any more time to play with it so I am hoping an expert can finish it off.  

#This script uses the .NET FileSystemWatcher class to monitor file and folder events inside a directory.  It will not monitor subdirectories.

Unregister-Event Folderdeleted
Unregister-Event FolderRenamed

$folder = 'S:\Transfer to Bob' # Enter the root path you want to monitor. this works windows 7 pro with S: being a sbs2003 share mapped to S:.
$filter = '*.*'  # wild card filter might be usefull in the future.

# In the following line, you can change 'IncludeSubdirectories to $true if required.                          
$fsw = New-Object IO.FileSystemWatcher $folder, $filter -Property @{IncludeSubdirectories = $false;NotifyFilter = [IO.NotifyFilters]'FileName, LastWrite'}


Register-ObjectEvent $fsw Renamed -SourceIdentifier FolderRenamed -Action { 
$name = $Event.SourceEventArgs.Name 
$oldname = $event.SourceEventArgs.OldName
$changeType = $Event.SourceEventArgs.ChangeType 
$timeStamp = $Event.TimeGenerated 

Write-Host " file '$name' was $changeType at $timeStamp" -fore white 
Out-File -FilePath c:\aaatmp\outlog.txt -Append -InputObject "The old file '$oldname' was $changeType to '$name' at $timeStamp"


$a = new-object -comobject wscript.shell
$intAnswer = $a.popup("Are you sure you want to change Master Directory name from '$oldname' to '$name' ", `
0,"Delete Files",4)
If ($intAnswer -eq 6) { #you answered Yes -- we are done
  } else {
  $a.popup("You answered no. I need more code")
 }


} 

Register-ObjectEvent $fsw Deleted -SourceIdentifier FolderDeleted -Action { 
$name = $Event.SourceEventArgs.Name 
$changeType = $Event.SourceEventArgs.ChangeType 
$timeStamp = $Event.TimeGenerated 

Write-Host " file '$name' was $changeType at $timeStamp" -fore white 
Out-File -FilePath c:\aaatmp\outlog.txt -Append -InputObject "Deleted '$name' at $timeStamp"

$a = new-object -comobject wscript.shell
$intAnswer = $a.popup("Are you sure you want to delete Master Directory named  '$name' ", `
0,"Delete Files",4)
If ($intAnswer -eq 6) { #you answered Yes -- we are done
  } else {
  $a.popup("You answered no. I need more code")
 }

Open in new window

0
rberkeConsultantAuthor Commented:
The last link was helpful in getting me started with a filesystemwatcher.  My final solution will be posted after it has been successfully used in production for a few weeks.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.