Adding File Level Audit in Windows Server

Select folder that want to be audited > Right Click > Properties > Security Tab > Advanced > Auditing Tab > Edit... > Add... Added "Everyone" > Click check names and OK > Set what you want to track > OK everything

In Event Viewer create a custom view:

Logged: Anytime

Event Level: Information

By Log - Event: Security

ID Numbers: 4656, 4660, 4663, 4670 to check on events(open file, delete, edit and create)

Reference: johndroid

https://community.spiceworks.com/topic/363079-using-event-viewer-to-track-changes-to-files