How can I monitor whether changes are made to audit policy settings?
Changes to security audit policy are critical security events. You can use the Audit Audit Policy Change setting to determine whether the operating system generates audit events when the following types of activities take place: Permissions and audit settings on the audit policy object are changed. The system audit policy is changed. Security event sources are registered or unregistered. Per-user audit settings are changed. The value of CrashOnAuditFail is modified. Audit settings on a file or registry key are changed. A Special Groups list is changed.
