Excluding Microsoft Office temporary files in the Change Auditor File System Template can cause "Last file write" events (for some file types) to work incorrectly.
This is a limitation resulting from the way Office creates and works with temporary files. This condition does not affect ‘File last write changed’ events and does not impact 3rd party application temporary files, which can be excluded normally.
Do not exclude .tmp files when auditing Microsoft Word and Excel files, but use an exclusion for the '~' as follows:
- Exclude a file starting with '~' you would use *~*.* to specify a non-recursive match (find match in the folder only; does not match any slash characters (\))
- Or use **~*.* to specify a recursive match (find match in the folder and all subfolders in audit path; matches slash characters (\) and directory names in paths)
- Or use **\*~*.* to exclude activity against all files with the specified file prefix found anywhere on all drives.
