Audit Folder Deletion

[SirCam]

Hi, I use Windows 2003 R2 SP2. I'm trying to audit folder deletion on a file server. I have set up the auditing GPO for Object access. On the file server I have selected Audit Authenticated Users, audit on Folder and Subfolders, and checked the Delete action. This works - it records folder deletions; however, it is also picking up some file deletions as well. I told it not to audit files, only folders. When I check audit properties on the files, there is nothing there, but when they are deleted they are logged. Why would this happen?
Thanks,
Cam.

 

[ITPangaeaArchitect]

my thought because the file deletion constitute a change to the directory structure, so it logs that. also possible the auditing is set for folder, subfolder,s and files on accident.

-Brandon Wilson
MCSE:Security00/03
MCSA:Messaging00
MCSA:Security03
A+