How To Monitor a Folder changes using Powershell

In our environment, large numbers of users are working on a daily basis and it very difficult to track what file they have modified and which time. To handle this scenario, my team was requested to monitor a directory for any file changes and receive alerts of those changes when they trying to update/Delete/renamed/created in a specific location inside the service and this requirement made me create this post. In this post, we will discuss how to monitor changes in the folder including sub-files, and log in to the log text file.

STEP #1

To monitor a folder for new files in Windows with PowerShell, we can use a .NET class called FileSystemWatcher. This class is in the System.IO namespace and can be created with the New-Object cmdlet.

$filewatcher = New-Object System.IO.FileSystemWatcher

STEP #2

To monitoring a folder/all sub-folders we need to assign the IncludeSubdirectories property as true.

$filewatcher.IncludeSubdirectories = $true

STEP #3

Then you need to specify which folder you I’ll be monitoring and also set the EnableRaisingEvents property to $true. The component is set to watch for changes in the last write and last access time, the creation, deletion, or renaming of text files in the directory. It will not raise events unless you set EnableRaisingEvents to true.

$filewatcher.EnableRaisingEvents = $true

STEP #4

In below code we using built-in [$event] variable. This is a variable that will be present every time an event fires and contains information such as the file path and the type of event that fired. In this script block, we capturing all the events in the FileWatcher_log.txt while event is fired.

$writeaction = { $path = $Event.SourceEventArgs.FullPath
$changeType = $Event.SourceEventArgs.ChangeType
$logline = “$(Get-Date), $changeType, $path”
Add-content “C:\D_EMS Drive\Personal\LBLOG\FileWatcher_log.txt” -value $logline
}

STEP #5

Finally, we need to register for the events. To perform this you need to use the Register-ObjectEvent cmdlet and need to supply it the watcher object we created and type of action to monitor like “Created”,”Changed”,”Deleted”,”Renamed”. The Register-ObjectEvent cmdlet subscribes to events that are generated by .NET objects on the local computer or on a remote computer.

Register-ObjectEvent $filewatcher “Created” -Action $writeaction
Register-ObjectEvent $filewatcher “Changed” -Action $writeaction
Register-ObjectEvent $filewatcher “Deleted” -Action $writeaction
Register-ObjectEvent $filewatcher “Renamed” -Action $writeaction

After executing the script, it will start to monitor the folder and sub-items from the given path and log the details in the FileWatcher_log.txt file.

Full Example

OUTPUT:

What do you think?

I hope you have an idea of  Monitoring a Folder Using PowerShell Scripting with Powershell. I would like to have feedback from the readers of my post. Your valuable feedback, question, or comments about this article are always welcome.

See more