This is my second attempt to find an answer to this problem.... I have a standalone server that I want to audit files created and removed from a shared folder. Everytime I enable Object Access auditing in the Local Policy, it immediatly starts auditing everything; reg keys accessed, system files accessed, everything all over the server. It files up the Security Event Viewer at a rate of about 4 events a second. Anyone else see this or know how to fix it? I only want the folder audited for files accessed, not the entire server. I've looked here, on the web, and Technet.

Hi!!! Most probably you have evey object in your computer enabled for auditing. You could disable auditing for those certain objects (files, folders, shared folders) by it would really be painstaking. If you get tons of audits, it would really be a bit weird. You should if you didn't - you get an object to be audit if you manually configured it for auditing (right click the object, properties, security, advanced, auditing). I'll just speculate. Maybe you have an unwanted entity in your computer [from shared folder].