I am trying to more closely audit my users access of files located on a file share. The files share is served by a server running windows server 2008 R2 and running the Windows Search Service. I am having a problem with too many Event 4663's ("An attempt was made to access an object").
The problem occurs because when a user browses to a folder using windows explorer and then executes a search on the file share, the system generates an event 4663 for each result returned.
This may generate thousands of events within a minute. Is there any way for me to change the way the search hits are logged? Perhaps the search service could have its own user? Or can i disable the ability to full-text search?