Enable the options you want to use. Logs both local and remote resource logins. File, directory, and printer access. Any attempt to access a file or application not granted to a user will be detected in this audit. Any user accounts or groups created, changed, or deleted.
Any user accounts that are renamed, disabled, or enabled.
Any passwords set or changed. Any changes to user rights or audit policies. Tracks program activation, handle duplication, indirect object access, and process exit. Files and folders must reside on an NTFS partition for security logging to be enabled. Once the auditing of file and object access has been enabled, use Windows NT Explorer to select auditing for individual files and folders.