Audit-Policy-ChangeWindows Event ID 4715: The audit policy (SACL) on an object was changedJuly 3, 2026Windows Event ID 4719: System audit policy was changedJuly 3, 2026Windows Event ID 4817: Auditing settings on object were changed (Global Object Access)July 3, 2026Windows Event ID 4902: The Per-user audit policy table was createdJuly 3, 2026Windows Event ID 4904: An attempt was made to register a security event sourceJuly 3, 2026Windows Event ID 4905: An attempt was made to unregister a security event sourceJuly 3, 2026Windows Event ID 4906: The CrashOnAuditFail value has changedJuly 3, 2026Windows Event ID 4907: Auditing settings on object were changedJuly 3, 2026Windows Event ID 4908: Special Groups Logon table modifiedJuly 3, 2026Windows Event ID 4912: Per User Audit Policy was changedJuly 3, 2026