Enabling auditing of object access will generate a lot of seemingly
unrelated events but that just goes with the territory. When configuring
auditing for a folder be sure just to specify the users or a group
containing the users you want to track instead of users or everyone. Then
audit only the permissions you want to track instead of every permission and
the type of permission whether it be success or failure. List and read
permissions will generate a lot of object access events for success. What
can really help is to use the free Event Comb from Microsoft to search the
security logs as you can specify particular events and also text strings
such as user name or folder/file name. That can help you quickly find
relevant information.   --- Steve