Netlogon shares are normally read-only, aren't they?

A simpler solution might be to use LogEvent(). You could log to the local computer and harvest the results, or even better, log to a central computer using the "target" parameter. I confess I've never tried to use the target parameter so I don't know what issues you might have.

You could also read the last accessed date/time of the files. So long as your anti-virus and backup software is not resetting these it should give you the information that you need.