Powershell 脚本跟踪用户目录访问

Question

我知道 Windows 中的 FileWatcher，但有没有办法跟踪用户是否只进入目录？我刚刚找到了用于打开、编辑和删除文件的代码。

$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = "C:\inetpub"
$watcher.Filter = "*.*"
$watcher.IncludeSubdirectories = $true
$watcher.EnableRaisingEvents = $true  

$action = { $path = $Event.SourceEventArgs.FullPath
            $changeType = $Event.SourceEventArgs.ChangeType
            $logline = "$(Get-Date), $changeType, $path"
            Add-content "C:\log.txt" -value $logline
          }    

Register-ObjectEvent $watcher "Created" -Action $action
Register-ObjectEvent $watcher "Changed" -Action $action
Register-ObjectEvent $watcher "Deleted" -Action $action
Register-ObjectEvent $watcher "Renamed" -Action $action

while ($true) {sleep 5}