Ah - permissions changes on files/directories are actually tracked via Windows File Auditing (or LEM's File Integrity Monitoring) which is a whole separate can of worms/events. The Auditable events are for things like users/groups, for file changes you can use File Audit Events (make sure you also have Windows File Auditing or LEM's File Integrity Monitoring turned on for that agent).
↧