How to get access denied for files logged in WIndows event log

Question

I need to log access denied events for files and directories on a Windows Server 2008 R2. How do I go about getting them into the Windows Event Log?

Solution

Turn auditing on, on the directories. See What is Windows Auditing? and Audit File System Depending on your need, you should also consider enabling global object access auditing See Global Object Access Auditing