Monitor and Server Health Group

Monitor pack for monitor Solution 7

It is very important to monitor the Audit policy in order to prevent a rogue administrator from turning auditing off, performing a forbidden action, and turning auditing back on.
You would be monitoring the following events for changes to your Audit Policy:

• 608 User Right Assigned
• 609 User Right Removed
• 610 New Trusted Domain
• 611 Removing Trusted Domain
• 612 Audit Policy Change