@IRJ said in Windows Server 2012 R2 - Share Auditing for Changes: I know you use wazuh.. Check this out https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html Thanks! Checking out setting this up. Hopefully, it will reveal the culprit.