Policies

• Audit account logon events
• Audit account management
• Audit directory service access
• Audit logon events
• Audit object access
• Audit policy change
• Audit privilege use
• Audit process tracking
• Audit system events

Auditing

When you open one of the audit policies, you may or may not be able to modify it, depending on whether the policy has been defined in a GPO that has been applied to the local system. If the computer is a member of an AD domain, the computer automatically applies appropriate GPOs from the domain. Any policy defined in a GPO overrides policies defined in the system’s local policy object and becomes the effective setting.

Windows Server 2003 and Windows XP always display the effective settings when in the Local Security Settings dialog box. (If you can modify the setting, the policy isn’t defined in any applicable GPOs defined in AD.) Windows 2000's Local Security Policy console puts the system’s local setting from effective setting in separate columns.

I recommend that you use the Local Security Policy console only for viewing a system’s audit policy—not for configuring it. As with all security settings, the best practice is to use Group Policy to centrally manage your audit policy.

Versions earlier than Windows 2003 disable all nine audit policies by default. Windows 2003 enables a few categories by default but the options selected make no sense from a security standpoint. Use Group Policy to push out the audit policy you want rather than relying on default settings. 

Post Windows 2003

With these versions of Windows, audit policy undergoes a major change. Each of the 9 audit policies now has 2 or more subcategories which can be individually enabled or disabled for success and failure. Make sure you understand and enable "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" before configuring with subcategories.