Hello All member
I enable file audit on folder for monitor already. How can I filter event id by this folder only to monitor who access ?
<QueryList><Query Id="0" Path="Security"><Select Path="Security"> *[System[band(Keywords,13510798882111488) and (EventID=5145)]] and *[EventData[Data[@Name='ObjectName']and(Data='K:\save\photo\55701-55800\55780\')]]</Select></Query></QueryList>