Audit-Policy-Change4715 The audit policy (SACL) on an object was changed4719 System audit policy was changed4817 Auditing settings on object were changed (Global Object Access)4902 The Per-user audit policy table was created4904 An attempt was made to register a security event source4905 An attempt was made to unregister a security event source4906 The CrashOnAuditFail value has changed4907 Auditing settings on object were changed4908 Special Groups Logon table modified4912 Per User Audit Policy was changed