Além das respostas acima:
Talvez você precise rastrear o arquivo?
Para isso, você pode usar o Log do Visualizador de Eventos.
Por exemplo,
Event ID :
4656
A handle to an object was requested
Logs the start of every file activity but does not guarantee that it succeeded
4663
An attempt was made to access an object
Logs the specific microoperations performed as part of the activity
4660
An object was deleted
The only way to verify an activity is actually a delete
4658
An object was closed
The handle to an object was closed How much time it took
Script útil: aqui
source: aqui
Para adicionar um evento personalizado:
click 'Create Custom View'
Select 'By Log'
pull down 'Event Logs'
Checkmark 'Windows Logs'
Move to the field and copy and paste in the event id numbers
click OK and name the view.