Hello,
The
default method to track File creation in ADAudit Plus is through
snapshot comparison of File/folder properties and it wouldn't
depends on security log events as there is no direct event ID to
track File creation action. We've managed to work on a
correlation which helps in parsing security logs to deliver the same
information. so the other method works based on security log events.
Regards,
ADAudit Plus Team