Is there a way to determine what login names have edited a Microsoft Word document? For example student A turns in an assignment completed in class, but student b actually was the one to do it. This could be proven if the author field of the document contained the currently logged in user who edited the document. Ideally I’d like the currently logged in user to be listed as the author, and force track changes to be enabled. Note this is on a windows domain so group policy is an option.

7 Answers 7


There are many possible non-solutions to this problem, using group policy to affect filesystem and Word options, all subject to at least one common failure... How do you detect one user using Copy and Paste to move the contents of the first document into one that they "authored"? I do not think that there is a technical solution to this problem.


As I recall, in the hazey cloud of the past, Microsoft Documents are generated with a Global Unique Identifier (GUID) that can and has been used forensically to trace the origin of a document.

The GUID and a plethora of non-visible data is archived with a Microsoft Word document in it's binary file formats, including user information in what is termed 'metadata.' More recently (relatively) people are finding it important to remove that information before releasing documents Office 97 2000 2003 (2007 is left as an exercise.)

And from their own KB articles:

Metadata is created in a variety of ways within Word documents. As a result, there is no single method that you can use to eliminate all such content from your documents. The following sections describe areas where metadata may be saved in Word documents.

Username: From the above link, MS Word 97, 2000, 2003 may use your network login name as the user details for documents created, last saved by under that account, likewise comments/macros added to existing documents.

Microsoft did not publish a programmatic way of extracting Username metadata stored in documents, although they do publish (see above links) how you can 'remove' data from being stored.

From around the web you can find stories of how extracting edit information, file locations has been used to shame politicians, so it's possible to get at the metadata, albeit with some work.

In my experience with Microsoft Word 2000, it is possible through the metadata to trace:

  1. authorship / edits - sequence in the document file equates to actual edits we observed
  2. Paths of storage (i.e. which directories/names and sequence did the file evolve through.)

Nothing that would stand up in a court of law (as per lack of actual documentation from Microsoft) but good enough in a course marking sequence to question authenticity of a document.

For Microsoft Word 2007 life might be easier as the metadata is directly accessible in the Docx / XML format. For those with love for pain, accessing Microsoft Word 97, 2000, 2003 user metadata involved the following for me:

  1. Get a Hex Editor (or File Search tool that looks into binary files)
  2. Towards the end of the document you'll find metadata such as _PID_HLINKS for hyperlinks(?) in the document as well as Document Summary etc. The top of the file seems to be file format/context information together with the actual text of the DOC.

With a good hex-editor, file/search tool you should see patterns that a relevant to your class scenario to make it easier to search through your documents.

Good luck

Edit: emphasise binary formats. Had a chance to look at MS Word RTF files today, and they definitely do not provide any Meta Data (as far as I can understand.)

  • Politicians are not in the same league as students. ;) Jun 30, 2009 at 9:11
  • No, ones a class of deviants. But so far as I can understand the Original Question, other than automation of finding the data, the User Details, File Storage Locations are stored in the document meta data.
    – samt
    Jul 4, 2009 at 20:40

You could enable "Audit Object Access". Enable auditing on individual files and folders you wish to watch. Do the following in your Group Policy Editor": Start > Run > gpedit.msc (or "local security policy" if it was not a member of a domain.)

Navigate to "Audit Policy" in the left pane. Double click on the "Audit Object Access" entry. Click on the "Success" and "Failure" checkboxes to enable auditing for files and confirm with "OK." Choosing "success" every access will be logged in the server's event log.

If you want to select single files or folders, right click on the file in Explorer, and choose "Properties". Select the "Security" tab and click the "Advanced" button. Select the "Auditing" tab and click on the "Add" button. Select the "Everyone" group and click on the actions you wish to audit and confirm.

This configuration lets you track down only access to the files which happened on the file server itself of course.

  • Auditing is easily defeated. Student A copies the file to another location, preferably another machine. Student B edits it. Student A then saves it back over the original. The logs will only show student A having modified the file. There will be no evidence student B has even so much as seen it. Jun 30, 2009 at 9:02
  • MS Word 97 - 2000 kept that information in the Meta data last time I used it. Unfortunately the Meta format isn't published and a hex editor is the only way to look at the file.
    – samt
    Jul 4, 2009 at 20:37

I don't think there's a simple technical solution (using Windows File Auditing features) to this requirement.

Especially if the objective is to track, if person B was working on something that was meant to be done by person A.

This is a requirement that relates to Identity Tracking (uniquely enough that can't be spoofed) and Automated Audit Checks coupled into a Document Management system.


I suppose having such kind of a requirement it's better to start thinking of Sharepoint Services installation and placing documents to its document library. Sharepoint supports keeping history of the uploaded and edited documents including the person (windows account) who worked with them and when. The only thing you should do in this case is to force anyone to share and submit documents only via Sharpoint document library.


Sorry, not in the Windows world. What you want cannot be achieved with Word and the Windows permissions are nowhere near granular enough to do it. Anything you might try can and will be circumvented by the students.

  • If you're teaching a Word Processing course (as per the Question) the majority of students will not be capable of hacking your group policy to change preferences for Word (e.g. strip identifying information from saved documents.) For the suggested problem space the data is available, automation is not available although some vendors tout they can provide that also.
    – samt
    Jul 4, 2009 at 20:42

From a non-technical standpoint: What's to stop student A from giving student B the password to their Microsoft account, and letting student B do the assignment through their account?

Then, student A turns in the printed assignment, their account having been the only one ever to access the document, and then student A goes home and changes the password so student B can no longer use the account.

Better yet, student A creates a "dummy account" in their name, and gives student B the password, assuming that student B is still more than willing to do what should be student A's work. As far as I know, the only thing that you might be able to prove, is that student A's account was accessed on student B's computer.

It doesn't seem like there's any way around this, but best of luck to you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.