Windows平台下如何检测共享资源中Python脚本的访问/复制行为及操作用户？

Great question—this is exactly the kind of targeted monitoring that’s tricky to find pre-built tools for, since most resources focus on file transfer completion rather than tracking who accessed/copied what. Let’s break down how to implement this with Python on Windows, leveraging the system’s built-in auditing capabilities.

Key Background #

Windows logs file access and share operations in its Security Event Log (if auditing is enabled). To get the user context you need, you can’t rely on basic file system watchers alone—you have to tap into these system logs, which Python can interact with via specific modules.

Recommended Python Tools & Approaches #

1. pywin32 + Windows Security Event Logs #

This is the most reliable method, as it directly taps into Windows’ built-in auditing. Here’s how to set it up:

• First, enable auditing for your shared folder:
  1. Right-click the shared folder → Properties → Security → Advanced → Auditing
  2. Add the users/groups you want to monitor, and check boxes for "Read" (for access) and "Write" (for copy operations)
• Use the pywin32 module to read and filter the Security Event Log for relevant events:
  • Event ID 4663: Tracks object access (including file reads/copies on shares)
  • Event ID 4656: Tracks file open operations (useful for identifying when a script is accessed)

Example Code Snippet

import win32evtlog
import win32evtlogutil

def monitor_shared_scripts(share_path):
    server = 'localhost'  # Use remote server name if monitoring a network share
    logtype = 'Security'
    hand = win32evtlog.OpenEventLog(server, logtype)
    flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ
    total = win32evtlog.GetNumberOfEventLogRecords(hand)

    for i in range(total):
        event = win32evtlog.ReadEventLog(hand, flags, 0)
        evt_id = event.EventID & 0xFFFF  # Mask to get the actual event ID

        # Filter for file access events on your shared script
        if evt_id in (4663, 4656):
            event_data = win32evtlogutil.SafeFormatMessage(event, logtype)
            # Check if the event relates to your shared Python script
            if share_path in event_data:
                # Extract the username from the event details
                user_start = event_data.find('SubjectUserName:') + len('SubjectUserName:')
                user_end = event_data.find('\n', user_start)
                username = event_data[user_start:user_end].strip()
                print(f"Python script accessed/copied by: {username}")

    win32evtlog.CloseEventLog(hand)

# Replace with your shared script path (e.g., "\\server\share\script.py")
monitor_shared_scripts("\\\\your-server\\shared-folder\\target-script.py")

2. WMI via wmi or pywin32 #

You can also use Windows Management Instrumentation (WMI) to monitor file operations on shares. The wmi Python module lets you query WMI classes that track file system events, and you can correlate these with user sessions.

• Note: WMI monitoring might have slight latency compared to event log parsing, but it’s useful for real-time alerts.
• You’ll need to monitor the Win32_FileOperationEvent class or set up a WMI event filter for file access on your shared path.

Critical Notes #

• Admin Rights Required: Both methods need elevated (administrator) privileges to read security logs or access WMI event data.
• Share Path Format: Use the UNC path (\\server\share\file.py) when targeting network shares, not local paths.
• False Positives: Filter events carefully—some system processes might access the file, so you’ll want to exclude service accounts if needed.

Why Basic File Watchers (like watchdog) Aren’t Enough #

Tools like watchdog can detect when a file is modified or accessed, but they don’t provide the user context (who performed the action). Since shared file operations happen over SMB, the user information is only stored in Windows’ system logs or WMI, not in the local file system metadata.

内容的提问来源于stack exchange，提问作者Salvatore