Hello all, I want to know when the settings have been changed (for example from Sucess, Failure to No Auditing, etc). Settings include Audit Privilege Use, Audit Process Tracking, Audit System events, etc. Thanks

Hello, You need to configure "Audit policy change" setting in Local Policies / Audit policy. Either in local security policy or in a GPO object if the machine is domain joined.Csaba

Hello, You need to configure "Audit policy change" setting in Local Policies / Audit policy. Either in local security policy or in a GPO object if the machine is domain joined.Csaba

Thanks, Consequences for NOT auditing Audit Privilege Use, Audit Process Tracking, Audit System events and Audit Object Access.?? Some of these settings tend to increase the log size and will eventually a DC's performance. Any best pratice from MS for these policy settings??

Depends on you audit requirements, you can fine tune audit settings in the Advanced Audit Policy Configuration section.Csaba