Before you implement auditing policy, you must decide which event categories you want to audit. The auditing settings that you choose for the event categories define your auditing policy. On member servers and workstations that are joined to a domain, auditing settings for the event categories are undefined by default. On domain controllers, auditing is turned on by default. By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization.

The event categories that you can choose to audit are:

• Audit account logon events
  
  
• Audit account management
  
  
• Audit directory service access
  
  
• Audit logon events
  
  
• Audit object access
  
  
• Audit policy change
  
  
• Audit privilege use
  
  
• Audit process tracking
  
  
• Audit system events
  
  

For more information about auditing, see Auditing Security Events.