1.

Solve : .bat tracking program!?

Answer»

hello again!!!
just want to monitor the files/folders in our server.
is there a .bat CODE to track if a file/folder was copied/opened/explored?
or some tips to identify if a file/folder was copied/opened/explored?
any suggestion??? Monitoring  and user notification of file creation, deletion, and MODIFICATION can be scripted with VBScript using the Windows Management Instrumentation (WMI) interface. Batch code simply does not have the functionality for this task.

The events you mentioned (copied/opened/explored) cannot be trapped. I guess Microsoft doesn't deem them worthy of notice. 

If you can use a VBScript, let us know and we'll see what we can WHIP up.

 

Quote from: night-rider on June 25, 2010, 04:25:45 AM

any suggestion???

Please avoid using multiple exclamation and question marks.
 
sorry!
oic!
then what will be the code then for vbs? Quote from: night-rider link=topic=106393.msg718370#msg718370 [img
[/img]date=1277250711]
hello again!!!
just want to monitor the files/folders in our server.
is there a .bat code to track if a file/folder was copied/opened/explored?
or some tips to identify if a file/folder was copied/opened/explored?

I am confused with that. Quote from: night-rider on June 26, 2010, 12:07:03 AM

sorry!
oic!
then what will be the code then for vbs?

Code: [Select]strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
    ("SELECT * FROM __InstanceOperationEvent WITHIN 3 WHERE " _   
        & "Targetinstance ISA 'CIM_Datafile' and " _
            & "TargetInstance.DRIVE = 'c:' And "_
      & "TargetInstance.Path= '\\temp\\'")

Do
    Set objLatestEvent = colMonitoredEvents.NextEvent()
    'WScript.Echo objLatestEvent.Path_.Class & " " & objLatestEvent.TargetInstance.Name

    Select Case objLatestEvent.Path_.Class
      Case "__InstanceCreationEvent"
      WScript.Echo "File Created: " & objLatestEvent.TargetInstance.Name
      Case "__InstanceDeletionEvent"
      WScript.Echo "File Deleted: " & objLatestEvent.TargetInstance.Name
      Case "__InstanceModificationEvent"
      WScript.Echo "File Modified: " & objLatestEvent.TargetInstance.Name
    End Select
Loop

You can change the drive and path as required. Use double backslashes. The WITHIN clause defines the time interval between snapshots. Make it too small and the script will run too often. Make it too big and you may miss some events. For example if you set it to 20 and a file creation event and file deletion event for the same file occurs within the 20 seconds, the script will not notice any change between snapshots and will not report either of the events.

Save the script with a VBS extension. Run from the command prompt as cscript scriptname.vbs. Best to run with cscript; wscript will produce popup windows which can be very annoying. Script RUNS in a loop waiting for events to happen in the directory defined in the script. If using cscript, use CTL-C to terminate the script. If using wscript, use the task manager to terminate the script.

Good luck.


Discussion

No Comment Found

Related InterviewSolutions