Enable Audit Policy manually on clients

To configure audit settings on machines running Microsoft^® Windows^® Vista or later:

1. Click Start > Run and key in secpol.msc. Press Enter.
2. From the Security Settings node, expand Local Policies > Audit Policy.

Local security policy window

3. From the right panel, double-click Audit object access.
4. From Audit object access Properties, select Success and Failure. Click OK.

Audit object access Properties

5. From the right pane, double-click Audit Process tracking.
6. From Audit process trackingGenerates events which track actions such as programs which are launched, closed, as well as other indirect object access information which contain important security information. For more information, refer to http://technet.microsoft.com/en-us/library/cc775520(WS.10).aspx Properties, select Success and Failure. Click OK.
7. From the right panel, double-click Audit account managementGenerates events when account management operations are done such as create/delete a user account or group, enable/disable a user account and set/change a user password. For more information, refer to http://technet.microsoft.com/en-us/library/cc737542(WS.10).aspx.
8. From Audit account management Properties, select Success and Failure. Click OK.
9. From the right panel, double-click Audit system eventsGenerates events when important system events happen such as user restarts or shuts down the target computer or when an event occurs that affects the security log. For more information, refer to http://technet.microsoft.com/en-us/library/cc782518(WS.10).aspx.
10. From Audit system events Properties, select Success and Failure. Click OK.
11. Close the local Security Policy window.