I am trying to work on windows 2008 file auditing function. I turn on 'Delete' audit on that folder
When I try to delete G:\file.txt, it always get duplicated record in Security Eventlog like in the following:
A handle to an object was requested.
Subject:
Security ID: HK\123
Account Name: 123
Account Domain: HK
Logon ID: 0x60a40b
Object:
Object Server: Security
Object Type: File
Object Name: G:\file.txt
Handle ID: 0xc04
Process Information:
Process ID: 0x184c
Process Name: C:\Windows\explorer.exe
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: DELETE
READ_CONTROL
SYNCHRONIZE
ReadAttributes
Access Mask: 0x130080
Privileges Used for Access Check: -
Restricted SID Count: 0
how could this happened?