Action to audit			Successful	Failed

Account Logon events				1
Account management			
Directory service access
Logon events
Object access			3		2
Policy change			5		5
Privilege use			4, 5		4, 5
Process tracking
System events			(4)		(4)