How to find files by owner using PowerShell and ADAudit Plus

In an organization it is quite common to see employees leaving or moving to another department. This would mean there would be a frequent change in file ownership. PowerShell's 'Get-ChildItem' cmdlet is used to retrieve the contents of a specified container. You can use this cmdlet to retrieve the Access Control List (ACL) of a file or folder.

Alternatively, ADAudit Plus, a comprehensive real-time Active Directory auditing solution helps you to find file owners easily through its easy-to-use interface. With this solution, you can view the comprehensive reports on folder owner changes, ACL changes, and folder permission changes. This also allows you to correlate various reports on file and folder activity, and make file management and security easier and more effective.

The following comparison shows how to find file ownership using PowerShell and ADAudit Plus.

Windows PowerShell

Steps to find files by Owner with PowerShell

Specify the file owner you want to retrieve the list of files for.

Specify the container to receive the list of child items from. Specifying the 'Recurse' parameter that retrieves child items from all child containers.

Specify the ACL file name.

Use the outfile parameter to define where to store the generated report.

Code:

[String]$username= "[username]"
[String]$outfile = "C:\scripts\searchowner.csv"
$path = Get-ChildItem "\\pdc\shared\HR" -Recurse
Foreach( $file in $path ) {
$f = Get-Acl $file.FullName
 if( $f.Owner -eq $username ) {
 Write-Host( "{0}"-f $file.FullName | Out-File
 -Encoding "UTF8"
 -FilePath $outfile -Append)
  }
}

 Copied

Click to copy entire script

ADAudit Plus

Steps to find files by owner with ADAudit Plus

Login to the ADAudit Plus web console with administrator credentials. Click the 'File Audit' tab and navigate to the 'Server Based Reports'. From the drop-down list, select the 'Folder Owner Changes'. This gives you a detailed report on folder ownership changes.

The 'Advanced Search' option allows you to filter the results according to the name, users who modified it, and permissions.

You can also view SACL changes in the 'Folder Audit Setting Changes' tab. The 'Folder Permissions Changes' tab reveals a history of changes to folder permissions.

How ADAudit Plus can make file and folder management easier for you?

Active Directory Auditing just got easier!

ADAudit Plus comes bundled with more than 300 predefined reports that makes your AD auditing easier. The solution also sends real-time alerts for critical events and thereby help you to secure your network from threats and boost your IT security posture. Check out the capabilities of ADAudit Plus here.

Download ADAudit Plus ADAudit Plus