檔案稽核手動查詢

<querylist> <query id="0" path="Security"> <select path="Security"> *[System[(EventID=4663) and TimeCreated[timediff(@SystemTime) <= 3600000]]] and *[EventData[Data[@Name='SubjectUserName'] and (Data='D\V1.xlsx')]] and *[EventData[Data[@Name='ProcessId'] and (Data='0x4')]] </select> </query> </querylist>

其他條件查詢方式：http://blogs.technet.com/b/askds/archive/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer.aspx

開啟稽核方式：找出亂砍檔案的兇手：『稽核原則』