Audit logs on Windows 2008 works different when file is modified from UNC path

Question

Hello All,
Here i have a strange situation with the generation of audit logs when folders\files are changed locally(my computer) on the server (vs) from the UNC path
(\\servername\drive$\folder\....).
File Server : Windows 2008 R2.
Audting enabled and SACL set on the folder level.
Enabled advanced auditing for Audit Object Access and enabled the force sub category audit settings on vista \ window 2008 policy via GPO and also verified that the sub category is set.
also set SACL on one folder on the R drive. (\\servername\r$\<folder>\<audited folder>
auditpol /get /category:"Object Access"
Object Access : File System                            
Success and Failure
Situation : 1
When i make any manipulations (traversing \ listing \ adding or deleting folder or files) on the server locally from my computer ---> . r drive --> folder --> audited folder , i get the event id generated (4663) with all the correct
information.
For ex: created a new txt file.
Object: Object Server: Security, Object Type: File, Object Name: R:\Audits1\folder1\New Text Document.txt, Handle ID: 0xcb4
Process Information: Process ID: 0x1bac , Process Name: C:\Windows\explorer.exe
Access Request Information: Accesses: WriteData (or AddFile) AppendData (or AddSubdirectory or CreatePipeInstance) , Access Mask: 0x6
Situation : 2
When i make the same  manipulations (traversing \ listing \ adding or deleting folder or files) on the server or remotely via the UNC path \\servername\r$\folder\audited folder or DFS share or \\servername\<sharename>
, i dont get the event id generated (4663) with the needed information.
For ex: created a new txt file.
Object: Object Server:      
Security , Object Type:File ,         
Object Name:         
R:\Audits1\folder1\New Rich Text Document (3).rtf , Handle ID:  
0xa3c
Process Information: Process ID: 0x4, Process Name:
Access Request Information: 
Accesses: WriteData(or addfile), Access Mask: 0x100
In the second situation process name is empty (for the file events) and also found that the logs generated are very less compared to the first situation.
Please suggest if there is any fix with this.
Thanks,

Answer 1

Enable the following auditing on the server either through domain
policy or local policy:
Audit logon events - Success
Audit Object Access  - Success
On the Auditing tab, add Everyone with the following audit settings.