Monitor Windows

[Rui]

Can I write a windows service in .NET that monitors what happens on a server?

(e.g.. which applications where started, what files where accessed, registry
changes,...)

[Tom Spink]

Rui wrote:

>
Can I write a windows service in .NET that monitors what happens on a
server?

(e.g.. which applications where started, what files where accessed,
registry changes,...)

Hi Rui,

Just to clarify, do you mean the service will be running *on* the machine
you want to monitor? Or you want to monitor a remote machine?

--
Hope this helps,
Tom Spink

[Rui]

Yes, the service will be running on the machine and will log all the actions
performed on a file.

"Tom Spink" wrote:

Rui wrote:

Can I write a windows service in .NET that monitors what happens on a
server?

(e.g.. which applications where started, what files where accessed,
registry changes,...)

Hi Rui,

Just to clarify, do you mean the service will be running *on* the machine
you want to monitor? Or you want to monitor a remote machine?

--
Hope this helps,
Tom Spink

[Michael Nemtsev]

Hello Rui,

It can be set via Windows.
File properties->Security Tab->Advances button->Auditing tab

Or use FileSystemWatcher class

RYes, the service will be running on the machine and will log all the
Ractions performed on a file.
R>
R"Tom Spink" wrote:
R>

>Rui wrote:

>>Can I write a windows service in .NET that monitors what happens on
a server?

(e.g.. which applications where started, what files where accessed,
registry changes,...)

Hi Rui,

Just to clarify, do you mean the service will be running *on* the
machine you want to monitor? Or you want to monitor a remote
machine?

--
Hope this helps,
Tom Spink

---
WBR,
Michael Nemtsev :: blog: http://spaces.msn.com/laflour

"At times one remains faithful to a cause only because its opponents do not
cease to be insipid." (c) Friedrich Nietzsche

[Tom Spink]

Rui wrote:

Yes, the service will be running on the machine and will log all the
actions performed on a file.

"Tom Spink" wrote:

>Rui wrote:

>
Can I write a windows service in .NET that monitors what happens on a
server?

(e.g.. which applications where started, what files where accessed,
registry changes,...)

Hi Rui,

Just to clarify, do you mean the service will be running *on* the machine
you want to monitor? Or you want to monitor a remote machine?

--
Hope this helps,
Tom Spink

Well, for file changes, the FileSystemWatcher class will probably be of some
use to you. As for when applications are started, that's a bit more
complex. There's no concrete event you can subscribe to, in order to get
such notifications. To ensure you get all process creation notifications,
the best way (that I know of) involves native DLLs and code injection, to
trap calls to CreateProcess (or in extreme cases NtCreateProcess).
Obviously, this technique is not possible in C# (or any .NET language).

--
Hope this helps,
Tom Spink