Custom Event ID 560 Report

Custom Event ID 560 Report

Good Day All,

Is it possible to create a custom 560 report to just show file accessed and not folders?  for example If I open a file called blah.txt located on c:\server\share, event 560 logs would show up for accessing the folder and the file.  I just want the file.  I looked at the difference between the file name and folder log files and it looks like i can sort by a ".".  The . does not show in any event id 560 files except for when it lists a file name like c:\server\blah.txt.  Is there anyway i can create a custom report to look just for . or just show the events that have file names in event id 560?

thanks in advance for this weird request...




                New to ADSelfService Plus?