after I enabled ntfs_event_publisher