Welcome to Event-o-Pedia
Ex: logon failure -"account disabled" -"LogType:Windows Event Log"
1 event(s) found in the alternate event classification Events by Business Needs
Found categories (1 - Events, 0 - Folders):
EventID 4912 - Per User Audit Policy was changed.
This event is always logged when an audit policy is disabled, regardless of the "Audit Policy Change" sub-category setting. Find more information about this event on ultimatewindowssecurity.com.
Operating System->Microsoft Windows->Built-in logs->Windows 2008 or higher->Security Log->Policy Change->Audit Policy Change->EventID 4912 - Per User Audit Policy was changed.