Sometimes I have wanted to monitor a directory for any file changes and receive alerts of those changes, for instance, when trying to find where an application is saving a configuration file. One solution I have come across is the small PowerShell module pswatch, which José F. Romaniello created.

How pswatch works

Pswatch is actually fairly simple in its design as it uses the .NET class System.IO.FileSystemWatcher. It returns the full path to any created, changed, deleted, or renamed file inside a directory. In addition, it can search within all subfolders of a directory.

A great feature of this module is that it continuously monitors directories, and since it writes the paths of files that change to the output, users can use a foreach loop in PowerShell and continuously perform logic on these objects. Obviously, there are numerous use cases for this.

Installing the module

The module unfortunately is not available in the PowerShell Gallery, but the creator's GitHub page does provide an installation PowerShell script that will create the module on a local machine. We can use this via Invoke-Expression:

PS C:\Users\dan\Documents> iex ((new-object net.webclient).DownloadString(""))
Creating module directory
Downloading and installing
Use "Import-Module pswatch" and then "watch"
PS C:\Users\dan\Documents> Import-Module pswatch

Monitoring a folder and sending email alerts

One simple example of using the module is monitoring a folder for changes and then emailing a user when a change occurs. To use the pswatch module, we use the command watch and follow this with a path to the folder we want to monitor. Here is an example of code that would do just that:

C:\> watch c:\examplefolder -includeDeleted | foreach {
>> Write-Output "Change made on $($_.Path)"
>> Send-MailMessage -Body $_.Path -From
>> -SmtpServer -Subject 'Change found' -To
>> }
Change made on c:\examplefolder\test\Newfile.txt

As you can see, the output is a string "Change made on" and the path to the created, modified, renamed, or deleted file.

A look into PowerShell help shows us the possible parameters for watch. These include location, subdirectories, changed files, renamed files, created files, and deleted files. All default to true except for deleted files, which is false.

C:\> Get-Help watch -Parameter * | Select-String -Pattern '-'

-location <String>
-includeSubdirectories [<SwitchParameter>]
-includeChanged [<SwitchParameter>]
-includeRenamed [<SwitchParameter>]
-includeCreated [<SwitchParameter>]
-includeDeleted [<SwitchParameter>]

Running pswatch as a service

Since we can use pswatch continuously, it makes it a great candidate for a Windows service that runs in the background at all times. The easiest way I found to do this was using a tool called nssm, which I found in Brandon Olin's post. Here, I use the same method Brandon used to create and start a service called "WatchExample," which is just a script containing my watch command used previously:

Subscribe to 4sysops newsletter!

Creating a service running pswatch

Creating a service running pswatch


PowerShell is not really known as a great tool for monitoring, but pswatch may be an exception to that thought. There are many use cases for using pswatch, even in DevOps scenarios such as kicking off unit tests as José states in the GitHub repository readme.

  1. Josh King (Rank 1) 4 years ago

    Wow, that really does simplify registering FileSystemWatcher events. Nice find (and write up), Dan!

  2. dilemma 4 years ago

    Can this be used only to monitor the folder permissions – ignoring files?

    • The watcher is based on the [System.IO.WatcherChangeTypes] class.

      The possibles monitoring values for this class are only:

      • Created
      • Deleted
      • Changed
      • Renamed

    • I found another class named [System.IO.FileSystemWatcher].

      With this one you can be notified for following object changes:

      • FileName
      • DirectoryName
      • Attributes
      • Size
      • LastWrite
      • LastAccess
      • CreationTime
      • Security

      There is already some code out there you can reuse.

      Just Google “powershell [System.IO.FileSystemWatcher] boe prox”

  3. Boy 4 years ago


    Thank you for this article. When I try to launch “watch” with a service create with NSSM, it don’t work. Can you show me your script Start-WatchExample.ps1 please ?

    The service loop on two states : running and start-up.



    • Mark Allen 3 years ago

      I am having the same issue, were you able to find a resolution? 

      • Mark Allen 3 years ago

        NV mind I found the issue; it was due to lack of permissions from the service to the watched folder. 


Leave a reply

Your email address will not be published.


© 4sysops 2006 - 2023


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account