Event Details
User Activity->Object Access->File System Object Access->InTrust Plug-in for File Access->Common File System Object Access->EventID 1793 - Object moved.
EventID 1793 - Object moved.
 Sample: 
Event Type:     SuccessAudit
Event Source:   Quest File Access Audit Source
Event Category: Remote Access
Event ID:       1793
Date:           10/28/2009
Time:           10:20:38
User:           RESEARCH\CBrown
Computer:       SERVER
Description:    
Object moved: 

	User Name: CBrown 

	User Domain: RESEARCH 

	User Logon ID: (0x0,0xF157E) 

	User IP Address: 10.0.0.1 

	Object Type: File 

	Object Path: C:\documents\Book.xls 

	New Path: C:\documents\backup\Book.xls 

	Transaction ID:
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Quest File Access Audit
Filtering Field Equals to Value
Category ITFA:Remote Access
Source Quest File Access Audit Source
EventId 1793
Expression RemoveCR(String20) not in ('File', 'Folder')
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 10.10.2000 19:00:00
Who Account or user name under which the activity occured. User Name CBrown
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "File System Object Moved" File System Object Moved
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. User IP Address 10.0.0.1
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain -
WhereDomain -
Result Successful or Failed "Successful" Successful
Object Name Object Path C:\documents\Book.xls
Object Type Object Type File
Whom -
Access Type Computer DC1
Comments
You must be logged in to comment