Righto. I'm having an issue trying to configure audit object access on my domain controller/file server. The problem is, I have verified mulitple times that there is no auditing configured for any files, folders, etc on the file server. Nothing. Everything has been wiped clean. Security > Advanced > Auditing > Remove all and apply to all children. I've done the same in the active directory. But whenever I turn on Object Access Auditing, BAM I get ~ 1000 events a second from Administrator and System. Even though there's no audit settings configured. I'm at my wits end, WHERE are the SACL's hiding that are initiating these audits! Anyone got any ideas or actually gotten Object Access Auditing to be useful?