hi from Spain, I have a laptop with windows xp pro 2002 sp 3. I'm studying auditing policies so i decided to enable auditing object access (successfull and failed) over "My Documents" to list every "List Folder/ Read data" access. What happens is that only a few seconds later and after i made a single access to the folder the list of items under event viewer is really huge. I remember from another occasion that that's not the way it should be, it should only list a few access items. What am I doing wrong? Thanks.