Monitoring "copied" or "moved" files in powershell

PowerShell Help
1

I have this list of event monitors:

Register-ObjectEvent $watcher Created -SourceIdentifier Created -Action $action
Register-ObjectEvent $watcher Changed -SourceIdentifier Changed -Action $action
Register-ObjectEvent $watcher Deleted -SourceIdentifier Deleted -Action $action
Register-ObjectEvent $watcher Renamed -SourceIdentifier Renamed -Action $action
#Register-ObjectEvent $watcher Moved -SourceIdentifier Moved -Action $action #"moved" is not an allowed event
#Register-ObjectEvent $watcher Copied -SourceIdentifier Copied -Action $action #"copied" is not an allowed event

So, “moved” and “copied” are not allowed events, how does one monitor a file that has been moved or copied? I have seen some scripts that monitor “create - delete” but that is not accurate or useful at all, especially in a work environment.

Any ideas?

2

I’m guessing that “$watcher” contains FileSystemWatcher, in which case when files are copied or moved into a watched folder it is considered a ‘Renamed’ event (changing the file path of a watched object is renaming it). However, you should read the entire section on copying and moving folders.

In particular, if you want to be notified that a file in a watched folder has been copied to another location, this will not work unless the end location that the file was copied to is also watched. If the file is copied from a watched location to an unwatched location, no event will be generated because the file in the watched location did not change.

3

thank you! I guess I will find out during test deployment, but I will update on what I find.