@cburr yep i know but i have problem Example in win 2k12 when i create new file Windows Evt have log create file 4663 right now but when in windows 2k8 must modify file ( rename, add content , ... ) then log 4663 modify file appear