When FULL DENY is explicitly set for a file in a folder in Windows 2008 R2 and the file is opened by the user, two events are recorded by Change Auditor
- Access to file <file_name> was denied on <file_server> by NTFS permissions. (Denied access: read, write).
- Access to folder <file_name>\ was denied on <file_server> by NTFS permissions. (Denied access: read, write).
It is expected that only the "Access to file" event should be recorded.