Configure Advanced Audit Policies

Advanced audit policies can be configured instead of local policies. Any of them are required if you want to get the “Who” and “When” values for the changes to the following monitored system components:

  • Audit policies
  • File shares
  • Hardware and system drivers
  • General computer settings

  • Local users and groups
  • Services
  • Scheduled tasks
  • Windows registry
  • Removable storage media

Perform the following procedures: