File, directory, and printer access. Files and folders must reside on an NTFS partition for security logging to be enabled. Once the auditing of file and object access has been enabled, use Windows NT Explorer to select auditing for individual files and folders. Access to anything requiring user rights. Any user accounts or groups created, changed, or deleted.
Any user accounts that are renamed, disabled, or enabled.
Any passwords set or changed. Any changes to user rights or audit policies. Tracks program activation, handle duplication, indirect object access, and process exit. Click the Success check box to enable logging for successful operations, and the Failure check box to enable logging for unsuccessful operations. Click OK .