Event Log Security - Windows Event Search

ID	Event Description
4819	Central Access Policies on the machine have been changed Audit Success
4826	Boot Configuration Data loaded Audit Success
4909	The local policy settings for the TBS were changed Not Implemented
4910	The group policy settings for the TBS were changed Not Implemented
5063	A cryptographic provider operation was attempted. Audit Success, Audit Failure
5064	A cryptographic context operation was attempted. Audit Success, Audit Failure
5065	A cryptographic context modification was attempted. Audit Success, Audit Failure
5066	A cryptographic function operation was attempted. Audit Success, Audit Failure
5067	A cryptographic function modification was attempted. Audit Success, Audit Failure
5068	A cryptographic function provider operation was attempted. Audit Success, Audit Failure
5069	A cryptographic function property operation was attempted. Audit Success, Audit Failure
5070	A cryptographic function property modification was attempted. Audit Success, Audit Failure
5447	A Windows Filtering Platform filter has been changed. Audit Success
6144	Security policy in the group policy objects has been applied successfully. Audit Success
6145	One or more errors occurred while processing security policy in the group policy objects. Audit Failure