What does access mask 12019f, 120196, 17019f, 17019b, 130196, 130197 corresponds to in 4656 event in event viewer

Question

 I applied audit policy to some shared folders in a file server. Then next day i took a look at the event viewer of the file server. I saw lot of 4656 events which differs in their access masks. I know that the accessmask corresponds to the accesses
that was granted to the user who are doing the modifications but i want to know whether these accessmasks(like 16019f, 120196, 12019f, 130197) corresponds to anything. 
For ex: The 4656 event with access mask 16019f occurs whenever i created a file through right click -> new text document
and why this set of accesses are granted to a user while file creation as specified above occurs. and if i created a file from notepad/word/any other application this event(4656 with access mask 16019f) is not occuring . Can anyone explain the logic behind
it.
do anyone know something similar to the above example. I want to know what does access mask 120196, 12019f, 130197, 130196, 17019b, 17019f corresponds to. If any one has any knowledge about it please enlighten me.  

Answer 1

The access mask is the hexadecimal representation of the bitmask describing the access requested/granted
http://msdn.microsoft.com/en-us/library/windows/desktop/aa374892(v=vs.85).aspx
http://blogs.technet.com/b/mspfe/archive/2013/08/27/auditing-file-access-on-file-servers.aspx
The Accesses represented by this value are listed in the same event (just above the access masks).
16019f adds up to be
FILE_WRITE_DATA/FILE_ADD_FILE FILE_APPEND_DATA/FILE_ADD_SUBDIRECTORY FILE_READ_E
A FILE_WRITE_EA FILE_READ_ATTRIBUTES FILE_WRITE_ATTRIBUTES READ_CONTROL WRITE_DA
C SYNCHRONIZE
MyAccessmask = &H16019f&
stroutput=""
if MyAccessmask and 0 then stroutput= stroutput & "FILE_READ_DATA/FILE_LIST_DIRECTORY "
if MyAccessmask and 1 then stroutput= stroutput & "FILE_WRITE_DATA/FILE_ADD_FILE "
if MyAccessmask and 4 then stroutput= stroutput & "FILE_APPEND_DATA/FILE_ADD_SUBDIRECTORY "
if MyAccessmask and 8 then stroutput= stroutput & "FILE_READ_EA "
if MyAccessmask and 16 then stroutput= stroutput & "FILE_WRITE_EA "
if MyAccessmask and 32 then stroutput= stroutput & "FILE_EXECUTE "
if MyAccessmask and 32 then stroutput= stroutput & "FILE_TRAVERSE "
if MyAccessmask and 64 then stroutput= stroutput & "FILE_DELETE_CHILD "
if MyAccessmask and 128 then stroutput= stroutput & "FILE_READ_ATTRIBUTES "
if MyAccessmask and 256 then stroutput= stroutput & "FILE_WRITE_ATTRIBUTES "
if MyAccessmask and 65536 then stroutput= stroutput & "DELETE "
if MyAccessmask and 131072 then stroutput= stroutput & "READ_CONTROL "
if MyAccessmask and 262144 then stroutput= stroutput & "WRITE_DAC "
if MyAccessmask and 524288 then stroutput= stroutput & "WRITE_OWNER "
if MyAccessmask and 1048576 then stroutput= stroutput & "SYNCHRONIZE "
wscript.echo stroutput
MCP/MCSA/MCTS/MCITP