Windows XP security event 560

I am currently attempting to update several system to meet government NISPOM specifications. These are clone and rack mount PC’s running Windows XP Pro. There are specific files that are restricted from acess, and these files, when changes are attempted, should generated a 560 security event in the event viewer. The issue is that none of the systems involved will record this event! Microsoft unfortunately has been no help to this point.