That would be a Windows file system function and I don't believe Windows
keeps track of that information.

Correct. By default this is not recorded. Unfortunately this is probably a
case of closing the stable door after the horse has already bolted but to
enable this you would need to enable auditing for the file in the OS. This
will then tell you which logged in user touched the file. I'm not sure that
this will give you the information that you are looking for as it does tent
to be very verbose. Be warned that this will probably generate a LOT of
traffic in your event log.


--
Benjamin Gay [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights