Audit file and object access failures. Auditing these events could create a large volume of event log entries. Audit successes and failures. Events created upon system shutdowns and restarts. File system auditing can only be used in conjunction with NTFS, not FAT file systems.
Administrators can choose to audit the child directories of the specified file as well.
Audit failure events for read, write, and execute to important files. Audit both success and failure events for delete, change permissions and take ownership of important files. Auditing successes may yield large volumes of log entries. Logs events generated upon the success or failure of a request to set the value of a key. Audits the creation of new subkeys.