If you want to tell when someone opened a file vs. a folder with FIM, you can change whether to look for an extension or not (i.e. *.* vs. just *). Or, you can audit the files you're interested in directly and not the parent directory with a mask. Or, if you explicitly want to know about the directory, you can configure FIM without recursion. There's a lot of noise that comes with reading a directory, though, regardless of whether it's windows or FIM auditing.