System audit policy was changed

What it means

Someone changed what gets logged. Attackers disable auditing right before the real action — hence critical.

First steps

1. 1Check the Subject and the source host.
2. 2Compare with the approved policy (auditpol /get /category:*).
3. 3If unplanned, treat as a security incident, not a glitch.

Related events

• 1102
• 4739