InTrust "File Access" report does not contain any data (4314749)

InTrust "File Access" report does not contain any data

When running the InTrust "File Access" report, the report does not contain any data even though it has been confirmed that the InTrust Repository and InTrust Audit Database contains the File Access Event ID 4663.

The InTrust "File Access" report only reports the details on the EventID 4663 events when they are accompanied by corresponding EventID 4656 and EventID 4658 events. The reasoning behind this is because the 4663 event documents actual operations performed against files and other objects.  This event is logged between the open (4656) and close (4658) events for the object being opened and can be correlated to those events via the Handle ID.