How to Find Files Modified by User

To find files modified by the user in PowerShell, you can use the Get-ChildItem cmdlet with the Get-Acl cmdlet to retrieve the file’s Access Control List (ACL) and filter the results based on the owner name.

The following method shows how to do it with syntax.

Method 1: Find files modified by the user in PowerShell

# specify the folder path
$folderPath = "C:\temp\log\"

# specify the user name
$userName = "Administrator"

# Retrieve the files modified by user

Get-ChildItem -Path $folderPath -Recurse | ForEach-Object { $acl = Get-Acl -Path $_.FullName
>> if($acl.Owner -match $userName) {$_}}

This example will list files modified by the user “Administrator“.

The following example shows how to use this method.

Find Files Modified by the User in PowerShell

You can use the Get-ChildItem cmdlet to retrieve the files from the specified directory and pipe them to the Foreach-Object to iterate through each file to get the file’s Access Control List (ACL) using the Get-Acl cmdlet.

Finally, it checks if the file owner’s name matches the specified user and lists files to the console.

# specify the folder path
$folderPath = "C:\temp\log\"

# specify the user name
$userName = "Administrator"

# Retrieve the files modified by user

Get-ChildItem -Path $folderPath -Recurse | ForEach-Object { $acl = Get-Acl -Path $_.FullName
>> if($acl.Owner -match $userName) {$_}}

Output:

After executing the above PowerShell script, it lists the files modified by the user. We can see the file name “system_log.txt” has been modified by the user “Administrator” recently.

Conclusion

I hope the above article on finding files modified by a user in PowerShell is helpful to you.

You can find more topics about Active Directory tools and PowerShell basics on the ActiveDirectoryTools home page.