| ID | Event Description |
|---|---|
| 4715 |
The audit policy (SACL) on an object was changed
Audit Success
|
| 4719 |
System audit policy was changed
Audit Success
|
| 4817 |
Auditing settings on object were changed
Audit Success
|
| 4902 |
The Per-user audit policy table was created
Audit Success
|
| 4904 |
An attempt was made to register a security event source
Audit Success
|
| 4905 |
An attempt was made to unregister a security event source
Audit Success
|
| 4906 |
The CrashOnAuditFail value has changed
Audit Success
|
| 4907 |
Auditing settings on object were changed
|
| 4908 |
Special Groups Logon table modified
Audit Success
|
| 4912 |
Per User Audit Policy was changed
Audit Success
|