Audit Policy: Policy Change: Audit Policy Change This subcategory reports changes in audit policy including SACL changes. Events for this subcategory include: ? 4715: The audit policy (SACL) on an object was changed. ? 4719: System audit policy was changed. ? 4902: The Per-user audit policy table was created. ? 4904: An attempt was made to register a security event source. ? 4905: An attempt was made to unregister a security event source. ? 4906: The CrashOnAuditFail value has changed. ? 4907: Auditing settings on object were changed. ? 4908: Special Groups Logon table modified. ? 4912: Per User Audit Policy was changed. Refer to the Microsoft Knowledgebase article ?Description of security events in Windows Vista and in Windows Server 2008? for the most recent information about this setting: http://support.microsoft.com/default.aspx/kb/947226.

(1) GPO: Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change!Audit Policy: Policy Change: Audit Policy Change (2) WMI: ###