This security setting determines whether the OS audits any of the following events: • Attempted system time change • Attempted security system startup or shutdown • Attempt to load extensible authentication components • Loss of audited events due to auditing system failure • Security log size exceeding a configurable warning threshold level. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, both successes and failures, or to not audit these events at all (i.e. neither successes nor failures). If Success auditing is enabled, an audit entry is generated each time the OS performs one of these activities successfully. If Failure auditing is enabled, an audit entry is generated each time the OS attempts and fails to perform one of these activities. Default: Security State Change Success Security System Extension No Auditing System Integrity Success, Failure IPsec Driver No Auditing Other System Events Success, Failure
For more control over auditing policies, use the settings in the Advanced Audit Policy Configuration node.
Windows Settings/
Security Settings/
Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy
After changing group policy options, you need to update group policy. If you do not update group policy then settings will not effect. To update it just simply type below command and also sample image is shown.
gpupdate /force
In about command we used "/force" option, this will help up to update policy options forcefully.
