Set the following events to be audited:
Audit account logon events
Audit account management
Audit logon events
Audit object access (Failure)
Audit policy change (Success)
Audit privilege use (Failure)
Audit system events (Success)
Set the following events to be audited:
Audit account logon events
Audit account management
Audit logon events
Audit object access (Failure)
Audit policy change (Success)
Audit privilege use (Failure)
Audit system events (Success)