问题：

[单选]

You are the network administrator for The network consists of a single Active Directory domain named All network servers run Windows Server 2003.
A member server named TK1 is located in an organizational unit (OU) named Servers. TK1 contains a folder named Contracts, which is configured to audit all the activity.
You are directed to review the audit log on Contracts. You want to identify any files that were modified during the past week by a user named Andrew. However, the audit log contains thousands of entries for the past week.
You need to view entries for Andrew's user account only.
What should you do?（）

A . In Active Directory Users and Computers, open the properties for Andrew's user account. View the Auditing tab of the Advanced Security Setting dialog box for his account.
B . In Windows Explorer, open Contracts. Add the Owner column for the file pane. Search for files that list Andrew as the owner.
C . On TK1, use WordPad to open C:\windows\system32\config\SecEvent.evt. Search for entries that contain Adrew's user account.
D . Edit the Group Policy object (GPO) for the Servers OU. Add Andrew's user account to the Generate security audits Group Policy option.
E . In Event Viewer, apply a filter to display only events that contain Andrew's user account in the User field.