I am trying to generate a report that shows who has accessed a file in a particular share on my Win2k8r2 server.

To this end I have enabled file auditing on the server for the share. (I can see events 4656, 4658, 4663 in my security log).

I have then tried to use the compliance reports in ELA 8.0 (build 8000) to show who has been accessing the monitored share.

Using a FISMA compliance (have tried others but they all seem to report the same thing) report I go to Object Access > Object Accessed > host and I can see the information I want, but I can't seem to screen out computer names or non file access events.

I have tried adding a Database filter to drop logs with SERVER01$ for example, but they still show up.

So I tried creating a custom report:

And while I can use the Edit Criteria tab to be more selective about what I see it returns the entirity of the log entry, when all I need is the summary that is shown in the compliance report.

How can I combine the two so I get a list of files accessed in a nice human (/manager) readable format?

Thanks in advance,

Jim