Determine who has created a file in Win XP (NTFS)

Question

Is there a way to determine which user created a file on Win XP with NTFS?

Answer 1

All files on NTFS have an "owner" which is displayed in

• the Owner column in Explorer's "Detailed" view (must be added manually; right-click the header)
• Properties - Security - Advanced - Ownership (in XP Professional)
• dir/q on Command Prompt

---

On Windows NT (starting with NT 3.1, including XP, 2003, Vista, 7, and future versions), all newly created objects are owned by their creator.

This is not limited to files: almost everything can have an ACL attached. Examples: named pipes, Registry keys, processes, services, desktops, devices, mutexes...

• Unless someone else takes ownership. (Administrators can do this by using SeTakeOwnership privilege; non-Administrators can take ownership if the object's ACL allows it.)

• On server editions of Windows NT, Administrators can assign object ownership to another user. Consumer editions (such as Windows XP or 7) only allow taking ownership to yourself.

• In Windows 2000 and earlier versions, if the creator is member of the Administrators group, the objects he creates will be owned by Administrators, not the user. This changed in Windows XP, where the user will always own objects he creates.

---

For most object types, you can even enable auditing, which causes all operations on the object to be logged to Security log. (You can choose which operations to log.)

For files, this can be done in Properties - Security - Advanced - Auditing. Use Event Viewer (eventvwr.exe) to see the log entries.