auditing:
Administrative Tool-Local Security Settings-Local Policies-Audit Policy-Audit object access
rightclick file-Properties-Security-Advance-Auditing: Failed on "Delete"
this particular setting works for recording overridden and failure to delete the file.