如何从重命名审计日志中确定新的文件名？

[Windows 2008 R2文件系统审核]

当我删除文件时，出现两个事件日志审计消息： 4663表示请求删除文件， 4660确认删除。 Thay可以通过属性Handlerjoin。

当我重命名文件时，出现两个事件日志审计消息： 4663这意味着请求删除文件和4663创build新文件（但只有文件夹path，没有文件名）

当我将文件从一个文件夹移动到另一个文件夹时，与重命名有相同的图片（因为移动实际上是重命名，确定）

当我创build一个新的文件，没有事件出现。

所以，问题：1.我缺less什么审计文件创build？ 2.我缺less什么来审计文件重命名？

我的AuditPol.EXE导出（DACL和SACL）：

 Category/Subcategory Setting System Security System Extension Failure System Integrity Failure IPsec Driver Failure Other System Events Failure Security State Change Failure Logon/Logoff Logon Success and Failure Logoff Success and Failure Account Lockout Success and Failure IPsec Main Mode Success and Failure IPsec Quick Mode Success and Failure IPsec Extended Mode Success and Failure Special Logon Success and Failure Other Logon/Logoff Events Success and Failure Network Policy Server Success and Failure Object Access File System Success Registry No Auditing Kernel Object No Auditing SAM No Auditing Certification Services No Auditing Application Generated No Auditing Handle Manipulation No Auditing File Share No Auditing Filtering Platform Packet Drop No Auditing Filtering Platform Connection No Auditing Other Object Access Events No Auditing Detailed File Share No Auditing Privilege Use Sensitive Privilege Use Failure Non Sensitive Privilege Use Failure Other Privilege Use Events Failure Detailed Tracking Process Termination Failure DPAPI Activity Failure RPC Events Failure Process Creation Failure Policy Change Audit Policy Change Failure Authentication Policy Change Failure Authorization Policy Change Failure MPSSVC Rule-Level Policy Change Failure Filtering Platform Policy Change Failure Other Policy Change Events Failure Account Management User Account Management Failure Computer Account Management Failure Security Group Management Failure Distribution Group Management Failure Application Group Management Failure Other Account Management Events Failure DS Access Directory Service Changes No Auditing Directory Service Replication No Auditing Detailed Directory Service Replication No Auditing Directory Service Access Success Account Logon Kerberos Service Ticket Operations Success and Failure Other Account Logon Events Success and Failure Kerberos Authentication Service Success and Failure Credential Validation Success and Failure Entry: 1 Resource Type: File User: CONTOSO\Domain Users Flags: Success Accesses: FILE_WRITE_DATA FILE_APPEND_DATA FILE_DELETE_CHILD DELETE The command was successfully executed.

这是一个复杂的答案。当我收集相关的链接（这是由于在审计系统中难以可靠完成的原因¹）时，请尝试：

使用SysMon并closuresEventID 2 。