Q. Why does the Windows 2003 R2 File Server Resource Manager (FSRM) file screen audit report contain three entries for file screen violations?

A. When you run a file screen violation audit report, you'll most likely notice most violations have three entries when only one attempt was made to write the illegal file type, as the sample report shows.

This glitch isn't a fault of the file-screening audit but rather a side-effect of the way most interfaces into the file system, including Explorer and the command shell, work. When a write or rename attempt fails, the shell will retry three times. Therefore, you'll see three entries in the file screen report.