Questions on Microsoft SystemOrchestrator 2022 Evaluation

Hi,

Can't see this in Event viewer as well.

Please try to Enable the System Event Audit Log

To capture the username or system making changes, you might need to enhance your runbook to include additional activities that can fetch this information. Unfortunately, the default File Monitor activity does not capture user details.

You can consider using PowerShell scripts within your runbook to query the file system for user information.

Here’s a basic example of how you might do this:

$path = "C:\path\to\your\file"
$events = Get-WinEvent -FilterHashtable @{LogName='Security';ID=4663} | Where-Object { $_.Properties[6].Value -eq $path }
foreach ($event in $events) {
    $user = $event.Properties[5].Value
    Write-Output "User: $user"
}

For your second issue with running the runbook using a Network share path or mapped drive root, it appears that the File Monitor activity in Orchestrator is designed to work with local paths. The example runbook for monitoring a folder specifies using local paths in the configuration. This might be why you are encountering syntax issues when trying to use network shares.