Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to determine which user created a file on Win XP with NTFS?

share|improve this question
Not natively, there may be 3rd party software that can be installed that will log this information. – Moab Mar 18 '11 at 16:00
up vote 6 down vote accepted

All files on NTFS have an "owner" which is displayed in

  • the Owner column in Explorer's "Detailed" view (must be added manually; right-click the header)
  • Properties - Security - Advanced - Ownership (in XP Professional)
  • dir/q on Command Prompt

On Windows NT (starting with NT 3.1, including XP, 2003, Vista, 7, and future versions), all newly created objects are owned by their creator.

This is not limited to files: almost everything can have an ACL attached. Examples: named pipes, Registry keys, processes, services, desktops, devices, mutexes...

  • Unless someone else takes ownership. (Administrators can do this by using SeTakeOwnership privilege; non-Administrators can take ownership if the object's ACL allows it.)

  • On server editions of Windows NT, Administrators can assign object ownership to another user. Consumer editions (such as Windows XP or 7) only allow taking ownership to yourself.

  • In Windows 2000 and earlier versions, if the creator is member of the Administrators group, the objects he creates will be owned by Administrators, not the user. This changed in Windows XP, where the user will always own objects he creates.

For most object types, you can even enable auditing, which causes all operations on the object to be logged to Security log. (You can choose which operations to log.)

For files, this can be done in Properties - Security - Advanced - Auditing. Use Event Viewer (eventvwr.exe) to see the log entries.

share|improve this answer
Thanks, great answer. Now I've found out who is locking an Excel file on the network drive. – James Mar 18 '11 at 16:12
@James: Regarding network drives: next time, fsmgmt.msc or net file could be useful. – grawity Mar 18 '11 at 16:20
Thanks, I can't seem to get these commands to work without admin rights though. It seems we will have to get the IT dept to sort it out. – James Mar 18 '11 at 17:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.