Auditing files and folders

[Guest gscanga]

I've enabled auditing on our file server by enabling the "Audit Objects"

policy within the systems Local Policy settings - both Success and Failures.

I then went to the root of the folder and drilled into the Advanced Security

settings to add the 'Domain Users' group and only checked the options for

Successful 'Delete', 'Delete Subfolders and Files', and 'Change Permissions'.

 

However when I review the Security logs, I see 'Object Access' category

entries that specify 'Joe User' accessed this file with 'READ ATTRIBUTES'

permissions.

 

These, of course, are extraneous entries and aren't what I'm looking for.

Can anyone shed some light on why these entries are being logged when I

didn't select that level of auditing?