How do I find out what or who is modifying a file daily on our file server?

TomKingTech 96 Reputation points
2021-01-05T14:18:26.487+00:00

We have a Windows file server that contains a .csv file that is updated the same time every weekday morning. Unfortunately, since this scheduled update was created by a former employee a long time ago without documentation, we have been unsuccessful finding out what is overwriting the file.

Here is what we have dug into to try to answer this question (without success)

  • File properties and histories
  • Task Scheduler for the file server in question
  • Task Scheduler for the local PC that uses the file
  • Event Viewer for the file server in question
  • Event Viewer for the local PC that uses the file
  • Both SQL Servers and their Task Schedulers/Event Viewers (since this .csv is updated using SQL records)

Any assistance you can provide to help me investigate what/who is updating this file would be greatly appreciated. It has been a challenge to find any forum posts on the Internet that discuss this and give a clear answer. I will, of course, update this post if I happen to find a solution.

SQL Server Integration Services
SQL Server Integration Services
A Microsoft platform for building enterprise-level data integration and data transformations solutions.
2,593 questions
Windows Server Storage
Windows Server Storage
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Storage: The hardware and software system used to retain data for subsequent retrieval.
654 questions
0 comments No comments
{count} votes

Accepted answer
  1. TomKingTech 96 Reputation points
    2021-01-05T14:46:21.493+00:00

    So I did discover the source of the updates: we have a separate file server that handles scheduled tasks that I did not have access to...it uses SSIS (SQL Server Integration Services) in order to write changes from the database table to this .csv file.

    So now we know how the .csv gets its data and receives updates. Thank you for your attention!

    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Anonymous
    2021-01-05T14:34:39.24+00:00

    You can turn on some file system auditing.
    https://learn.microsoft.com/en-us/windows-server/identity/solution-guides/plan-for-file-access-auditing

    --please don't forget to Accept as answer if the reply is helpful--

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.