Windows Event Log - Audit Policy Change Management

Event Id	Description
4670	Permissions on an object were changed.
4715	The audit policy, SACL, on an object was changed.
4719	System audit policy was changed.
4817	Auditing settings on object were changed.
4902	The Per-user audit policy table was created.
4906	The CrashOnAuditFail value has changed.
4907	Auditing settings on object were changed.
4908	Special Groups Logon table modified.
4912	Per User Audit Policy was changed.
4904	An attempt was made to register a security event source.
4905	An attempt was made to unregister a security event source.