Ok I know I'm overthinking this one but can anyone tell me what file I should audit in order to determine if the CD-COM was used for recording or is there a audit policy madness? Currently I'm auditing execution of the software used to write to CD but wondered if there was somthing more general I can audit? Take care, Johnny Mac
