I was trying to audit file access in a Windows 2008 R2 server, and (my fault) enabled it for the entire volume (say, disk e:). Of course I was getting lots of entries in the security log, a big amount to handle -and even bigger when trying to understand how this works. Anyway, I deleted the SACL for the volume (Properties, Security, Advanced, Audit), but all file access kept being audited. If I disable object access auditing in the local policies the system stops logging, but when I create a test folder, set its SACL and enable auditing, the entire disk object acccess starts to being audited again, even when its own SACL is empty. I also set and deleted SACL in the first folder level, just in case it was an inheritance issue, but got no results. Can you guys help me with this? I am not using advanced auditing, by the way. T.I.A.
Jorge