asked on

how to run event code when a server folder is renamed or deleted

I want to monitor a server folder so that changes to a sub-folder are passed to small audit program. The goal is to warn the users before they make a change.

' something like this
Sub folderchange(oldFolder As Object, newFolder As Object, cancel As Boolean)
    If LCase(oldFolderParent.Foldername) Like "*special*" Then
        If MsgBox("are you sure you want to change " & oldFolder.ParentFoldername, vbYesNo + vbDefaultButton2)  <> vbYes Then
            cancel = True
        End If
    End If
End Sub

Open in new window

I have done some event programming in Outlook, Excel and MS Access, but I don't know how to do it for a file system object.

Perhaps I could put a vbscript program into the users daily logon ??? But other approaches are welcome -- I don't care if the script runs on the server or the client CPU just whichever is easiest.

My environment is an SBS 2003 server with Windows 7 pro clients. (Please -- no lectures about unsupported server software ;-)

it_saige

First you would need to setup auditing for the File(s)/Folder(s):

Step-By-Step: How to audit file and folder access to improve Windows 2000 Pro security

Then you will want to create a task on your clients that runs a script or displays a message or some other such action when the client actions cause the event to be triggered:

Attaching Tasks to Event Viewer Logs and Events

-saige-

Robert Berke

ASKER

Does anybody here have experience with Power Shell FileSystemWatcher? I think that might be more appropriate for my needs.

Our "level 0 special root directory" has 200 level 1 folders and MANY more lower level folders and files (over 200,000). I only want to watch the 200 level 1 folders which are hardly ever changed.

Saige - The audit approach outlined in your "step-by-step" link contains warnings which seems to be directed directly at me.

Auditing object access
You must be careful which objects you audit or you will end up with the information overload problems.

It's very easy to end up with information overload because if you audit a folder, the audit applies to every object within the folder and within any subfolders. The audit applies to child objects, grandchild objects, and so on. So when possible, I recommend auditing objects at the file leve

l.

I think my 200,000 files get so much daily activity that the audit approach would be inefficient.

ASKER CERTIFIED SOLUTION

it_saige

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Robert Berke

ASKER

the following code does a pretty good job but it is not perfect.

The main problem is that the filewatcher is only activated AFTER the folder is changed. If the folder is renamed, my script could rename it back to the original. But, I have no idea what to do if the folder is deleted.

I don't have any more time to play with it so I am hoping an expert can finish it off.

#This script uses the .NET FileSystemWatcher class to monitor file and folder events inside a directory.  It will not monitor subdirectories.

Unregister-Event Folderdeleted
Unregister-Event FolderRenamed

$folder = 'S:\Transfer to Bob' # Enter the root path you want to monitor. this works windows 7 pro with S: being a sbs2003 share mapped to S:.
$filter = '*.*'  # wild card filter might be usefull in the future.

# In the following line, you can change 'IncludeSubdirectories to $true if required.                          
$fsw = New-Object IO.FileSystemWatcher $folder, $filter -Property @{IncludeSubdirectories = $false;NotifyFilter = [IO.NotifyFilters]'FileName, LastWrite'}


Register-ObjectEvent $fsw Renamed -SourceIdentifier FolderRenamed -Action { 
$name = $Event.SourceEventArgs.Name 
$oldname = $event.SourceEventArgs.OldName
$changeType = $Event.SourceEventArgs.ChangeType 
$timeStamp = $Event.TimeGenerated 

Write-Host " file '$name' was $changeType at $timeStamp" -fore white 
Out-File -FilePath c:\aaatmp\outlog.txt -Append -InputObject "The old file '$oldname' was $changeType to '$name' at $timeStamp"


$a = new-object -comobject wscript.shell
$intAnswer = $a.popup("Are you sure you want to change Master Directory name from '$oldname' to '$name' ", `
0,"Delete Files",4)
If ($intAnswer -eq 6) { #you answered Yes -- we are done
  } else {
  $a.popup("You answered no. I need more code")
 }


} 

Register-ObjectEvent $fsw Deleted -SourceIdentifier FolderDeleted -Action { 
$name = $Event.SourceEventArgs.Name 
$changeType = $Event.SourceEventArgs.ChangeType 
$timeStamp = $Event.TimeGenerated 

Write-Host " file '$name' was $changeType at $timeStamp" -fore white 
Out-File -FilePath c:\aaatmp\outlog.txt -Append -InputObject "Deleted '$name' at $timeStamp"

$a = new-object -comobject wscript.shell
$intAnswer = $a.popup("Are you sure you want to delete Master Directory named  '$name' ", `
0,"Delete Files",4)
If ($intAnswer -eq 6) { #you answered Yes -- we are done
  } else {
  $a.popup("You answered no. I need more code")
 }

Open in new window

Robert Berke

ASKER

The last link was helpful in getting me started with a filesystemwatcher. My final solution will be posted after it has been successfully used in production for a few weeks.