Auditing

Here is the official answer from the Microsoft official Curriculum "because auditing creates overhead on the CPU and on the HD, always audit only those events that provide information that is useful in your network". You can audit a share because you can audit "file and object access", but I don't know about offloading the I/O to another W/S. If the share is on a W/S you could set up the audit locally.

This question was closed by the author