Enable Object Access Policy

1. On the Commander application server, open the Local Security Policy. 
2. Expand Local Policies > Audit Policy. 
3. Double click Audit object access and enable auditing on Success and Failure. 

Edit Auditing in File Location

1. Locate the directory in which you want to track file creation/deletion. Right-click the folder and choose Properties.
2. Switch to the Security tab and click Advanced. 
3. Click Add. 
4. Click Select a principal. Enter the name Everyone and click Check Names. Everyone should now be underlined. Click OK.
5.  Make sure the audit entry applies to : This folder, subfolders and files.
6. Click Show advanced permissions and make sure everything is enabled. Check Only apply these auditing settings to objects and/or containers within this container. Click OK.  

Viewing Audit Logs

1. Launch Event Viewer.
2. Filter the Security log to display event ID 4656 (indicates that access handle to an object was requested).