Hi all, experts I have the following problem: I need to audit object access to files contained in a particular folder. I set it up in the local security policy and in the folder security properties. I have a series of events fired whenever I access a particular file, and this is good. What is not, is that I've got lots of events when just browsing the folder using Windows Explorer. Windows 2003 fires an event for any single files into the directory: the event ID is 560 (which is the event related to object access, good), and is like this one: Object Open: Object Server: Security Object Type: File Object Name: C:\TEST\mng_lgwr_428.trc Handle ID: 2492 Operation ID: {0,17148959} Process ID: 3020 Image File Name: C:\WINDOWS\explorer.exe Primary User Name: Administrator Primary Domain: LOGONE Primary Logon ID: (0x0,0xE2C12C) Client User Name: Administrator Client Domain: LOGONE Client Logon ID: (0x0,0xE2C12C) Accesses: READ_CONTROL ACCESS_SYS_SEC ReadAttributes Privileges: SeSecurityPrivilege Restricted Sid Count: 0 Access Mask: 0x1020080 Any idea why this happens? Maybe something in the folder settings? Thanks in advance for your reply Stefano

you can use the filter options in event viewer to pin point the desired event. all the event are listed here http://technet.microsoft.com/en-us/...