Custom Event ID 560 Report
Good Day All,
Is it possible to create a custom 560 report to just show file accessed and not folders? for example If I open a file called blah.txt located on c:\server\share, event 560 logs would show up for accessing the folder and the file. I just want the file. I looked at the difference between the file name and folder log files and it looks like i can sort by a ".". The . does not show in any event id 560 files except for when it lists a file name like c:\server\blah.txt. Is there anyway i can create a custom report to look just for . or just show the events that have file names in event id 560?
thanks in advance for this weird request...
New to ADSelfService Plus?