Windows Security Log Events by Category

Overview:

The Audit account management events policy, which you can use to monitor changes to user accounts and groups, is valuable for auditing the activity of administrators and Help desk staff. This policy logs password resets, newly created accounts, and changes to group membership. On DCs, the policy logs changes to domain users, domain groups, and computer accounts. On member servers, it logs changes to local users and groups....read more