If you exclude .tmp files, Change Auditor will not see all these steps. When our agent sees these steps, automatically change the 4 events into 1 write event and excludes the event from auditing.
WORKAROUND:
Do not exclude .tmp files when auditing Microsoft Word and Excel files, but use an exclusion for the '~' as follows:
Exclude a file starting with '~' you would use *~*.* to specify a non-recursive match (find match in the folder only; does not match any slash characters (\)).
or use **~*.* to specify a recursive match (find match in the folder and all subfolders in audit path; matches slash characters (\) and directory names in paths).
or use **\*~*.* to exclude activity against all files with the specified file prefix found anywhere on all drives.
This workaround works well for Word files, but auditing Excel files still accumulates the create (xxx.tmp), the rename (xxx.tmp) and the delete (xxx.tmp) events along with the desired File Last Write Changed event.