[Autogenerated] Your tasked with monitoring a critical server
directory to ensure that you're aware of any changes that might
indicate security concerns or operational issues.
We want to log activity in this file folder in this demo,
I'll guide you through setting up a WM I event watcher using
PowerShell to monitor file system changes.
In real time.
We'll create a WM I event filter to watch for changes in a specific directory.
We'll then use the register sim indication event
kamille to listen for these changes.
And then finally,
we'll write an action script lock that logs all the details of any
final system change in that folder to a log file.
Today,
we're going to dive deep into the power of W I events
to monitor file system activity.
We're going to create an event monitor,
ensuring we're immediately alerted to any changes in
critical file system activity in a folder.
Now, since this task requires a bit of code,
I've already written it up as you can see and I've created a script.
This might be a lot to take in initially as beginner.
So let's break down each section and explain what's going on first.
I want to monitor for new files created and removed in
the C critical directory folder.
I want to then log that activity into a text file that's located
at C file system change log dot text here.
I'm setting these variables as a best practice in
case I want to change these later.
Next, the script is creating the watcher.
The file system watcher is a .NET object that we're creating.
It's then setting the folder path to monitor,
ignoring any subdirectories in that path.
And then finally enabling the Watcher.
Next, the Watcher must know what to do when it detects an event.
This is what the script loop we're calling action is for it formats
the message with a date time and details of the change and then
adds this information to the log file.
Now notice the script lock has two parameters here.
When an event is fired,
it will always pass a value which is the source which you'll
see and a message to the script block.
Now the watcher is enable at this point.
But to make it functional,
you must register the type of events it should look for.
In this case,
we're using register object event to tell the Watcher to
look out for specific types of changes like files being
created or deleted in this instance.
And it's going to then use the action and created
earlier when these changes happen.
Now that we cover the script.
Let's see what it looks like in action.
So first I need to invoke the script.
One important thing to notice here.
Notice that I'm starting this script with a dot That's called dot sourcing.
The file system watcher depends on the session you're running it in.
If I were to just run this script as normal,
it would create the file system watcher in another scope
and it would not work dot sourcing.
Insert it created in the scope that I'm currently running in here.
So now that it's running,
you can see that the register object event references there,
output the file created and file deleted,
objective event references.
And now just to be sure,
you can actually see which events were registered by
running the G event subscriber command.
And there you can see that we have two file system watchers running.
We have subscribed to those events.
Now that's running,
it should be watching for all files created and deleted inside of that folder.
So let's test it out.
I'll create a new test file in that folder, right?
And then I'll remove it just to get some file activity.
Now, let's see what our log shows and there you go.
It says we have two references, we have the time stamp and everything.
Let's see if it actually created and deleted.
Yep, the file was created and deleted.
You should see that it captured all that activity.
So it worked.
Now it will continue to monitor this folder forever.
Now, as long as I keep this PowerShell session open or I manually remove it.
Let me show you how you can manually remove this to remove the watcher.
You first must unregister the events you previously registered.
This essentially disables it.
You can do that with the unregistered event command.
Let's specify the source identifier of the ones that we created earlier.
And you can see that those have no output, which means they're good.
We can run, get event subscriber again and hopefully we won't see anything.
Yep.
There we go.
It returns nothing.
So now it's all removed.
It's no longer looking at the folder.
So now you have some code and understanding to keep tabs
on any folder on your Windows servers.