change in cmd audit