I think but am not sure that editing a file is really three steps; one is a creation of a new file of only changes and then a creation of a new file with changes, and then deleting the old file. I read this somewhere but it may only apply to Word and Excel.
Word does create a tmp file to house changes. You can see that in the Explorer.
--
Mark-Allen Perry
ALPHA Systems, Switzerland
mark-allen AT mvps DOT org
"Anthony" <(E-Mail Removed)> wrote in message news

C25B56E-3105-49F3-9E7D-(E-Mail Removed)...
I have set up auditing for a directory and we are auditing a handful of word and excel files. We a user makes a change to a file under event viewer it shows as Event ID 560 - Deletion. Is that right? Shouldn't it reflect a different status?
When deleting a file it shows are deletion so that part of auditing is working. Any suggestions?
Thanks.
Anthony