To enable the logging of user-level file access events in the Windows TFM, follow the instructions in the attached file.  The specific details and screenshots shown here may vary slightly between versions of Windows, but this will identify the key settings required for this logging.

Once the logging of the specific events has been enabled, they can be analyzed by various software systems, such as Splunk or others.