System audit policy

Category/Subcategory                      Setting
System
  Security System Extension               No Auditing

  System Integrity                        Success and Failure

  IPsec Driver                            No Auditing

  Other System Events                     Success and Failure

  Security State Change                   Success

Logon/Logoff
  Logon                                   Success and Failure

  Logoff                                  Success

  Account Lockout                         Success and Failure

  IPsec Main Mode                         No Auditing

  IPsec Quick Mode                        No Auditing

  IPsec Extended Mode                     No Auditing

  Special Logon                           Success

  Other Logon/Logoff Events               No Auditing

  Network Policy Server                   Success and Failure

  User / Device Claims                    No Auditing

  Group Membership                        No Auditing

  Access Rights                           No Auditing

Object Access
  File System                             No Auditing

  Registry                                No Auditing

  Kernel Object                           No Auditing

  SAM                                     No Auditing

  Certification Services                  No Auditing

  Application Generated                   No Auditing

  Handle Manipulation                     No Auditing

  File Share                              No Auditing

  Filtering Platform Packet Drop          No Auditing

  Filtering Platform Connection           No Auditing

  Other Object Access Events              No Auditing

  Detailed File Share                     No Auditing

  Removable Storage                       No Auditing

  Central Policy Staging                  No Auditing

Privilege Use
  Non Sensitive Privilege Use             No Auditing

  Other Privilege Use Events              No Auditing

  Sensitive Privilege Use                 No Auditing

Detailed Tracking
  Process Creation                        Success and Failure

  Process Termination                     No Auditing

  DPAPI Activity                          No Auditing

  RPC Events                              No Auditing

  Plug and Play Events                    No Auditing

  Token Right Adjusted Events             No Auditing

Policy Change
  Audit Policy Change                     Success

  Authentication Policy Change            Success

  Authorization Policy Change             No Auditing

  MPSSVC Rule-Level Policy Change         No Auditing

  Filtering Platform Policy Change        No Auditing

  Other Policy Change Events              No Auditing

Account Management
  Computer Account Management             Success

  Security Group Management               Success and Failure

  Distribution Group Management           No Auditing

  Application Group Management            No Auditing

  Other Account Management Events         No Auditing

  User Account Management                 Success and Failure

DS Access
  Directory Service Access                Success

  Directory Service Changes               No Auditing

  Directory Service Replication           No Auditing

  Detailed Directory Service Replication  No Auditing

Account Logon
  Kerberos Service Ticket Operations      Success

  Other Account Logon Events              No Auditing

  Kerberos Authentication Service         Success

  Credential Validation                   Success