How to enable auditing for a folder only (and not anything within that folder)

Question

I am trying to track down a process responsible for resetting ACLs on a particular folder, and ONLY that folder, not any of the 10,000 folders and files it contains.

I tried going to Properties > Security > Advanced > Auditing to add auditing there, without checking the "Replace all existing auditing entries on all descendants...". When I apply the auditing, the Security Log clearly shows the ACL being changed on descendant files, and I see auditing events for those files in that log.

I also tried the PS script here: http://blogs.technet.com/b/bulentozkir/archive/2009/12/26/bir-dizinde-folder-everyone-i-in-auditing-i-aktif-eden-rnek-powershell-scripti.aspx

But the results were the same.

Answer 1

On the Auditing page, when you add the Auditing entry, make sure for "Apply onto:" you select

"This folder only"

and not the default

"This folder, subfolders and files".

Also, select "Apply these auditing entries to objects and/or containers within this container only"