Auditing Security Events

Auditing Security Events
Auditing tracks the activities of users and security-sensitive changes to the system by recording in the Security log the events that you specify. For example, you can choose to audit failed logon attempts, which might indicate that someone is trying to log on with an invalid password (perhaps using a program to automate the attack). Or you might want to monitor the use of a particularly sensitive file. You can also choose to monitor changes to user accounts and passwords, changes to security policies, and use of privileges that might reveal that someone is trying to "administer" your computer—perhaps not with your best interests in mind.