In Audit logs, Event IDs 4656 and 4663 getting reported simultaneously and corresponding to a third party auditing tool (AD AuditPlus) indicates that the same user has created and deleted the same fil...In Audit logs, Event IDs 4656 and 4663 getting reported simultaneously and corresponding to a third party auditing tool (AD AuditPlus) indicates that the same user has created and deleted the same file path at the same time stamp The above behavior is specific to files with the extensions .docx and .xls. Simultaneous deletion and creation operations in audit logs can occur when an object is being replaced or updated/modified. It never results in deletion of actual file/folder