I'm assuming you have enabled auditing. http://knowledgebase.solarwinds.com/kb/questions/3454/How+to+enable+file+auditing+in+Windows
Here is what our filter looks like. We have it set up to track deletions, creations, traversals...etc. The joys of PCI.
You could probably get away with: