Hello, Phuff!

Actually, to accomplish what you want you will a driver.
Another way, using 'little hack' is called dll-injection. Using this technique
you can intercept calls to Win32 functions ( e.g. DeleteFile(...) ).

P> Okay, I am writing a service that monitors the file system on one of
P> our servers and I can take of that in a cinch.  However, I found no
P> properties or methods available to see who the user is that controls
P> the process performing the deletion.  I also need to know what
P> application is doing the delete.  I only want to know when a user is
P> manually delete a file through windows explorer.  Any suggestions?
P> Any
P> P/Invoke hooks?

--
Regards, Vadym Stetsyak
www: http://vadmyst.blogspot.com