I have file and folder object access auditing set up on my Windows 2000 server to log only when someone deletes a file or folder, but for some reason, it logs all different kinds of object access. Also, I have it set up to audit four different user groups (not the Everyone group) but it still creates a log entry when the system accesses something.

I made sure that in the auditing properties for each group that only the delete boxes were checked, and I also performed a secedit in case it needed it.

I referred to the Windows 2000 help file, but found nothing that helped with my situation.

How can I get my server to only report file and folder deletions for the designated groups, and prevent my security log from reporting file access made by the system?

Thanks for any help!