| System | Security System Extension | Failure |
| System Integrity | Failure |
| IPsec Driver | Failure |
| Other System Events | Failure |
| Security State Change | Failure |
| Logon/Logoff | Logon | Success and Failure |
| Logoff | Success and Failure |
| Account Lockout | Success and Failure |
| IPsec Main Mode | Success and Failure |
| IPsec Quick Mode | Success and Failure |
| IPsec Extended Mode | Success and Failure |
| Special Logon | Success and Failure |
| Other Logon/Logoff Events | Success and Failure |
| Network Policy Server | Success and Failure |
| User / Device Claims | Success and Failure |
| Object Access | File System | No Auditing |
| Registry | No Auditing |
| Kernel Object | No Auditing |
| SAM | No Auditing |
| Certification Services | No Auditing |
| Application Generated | No Auditing |
| Handle Manipulation | No Auditing |
| File Share | No Auditing |
| Filtering Platform Packet Drop | No Auditing |
| Filtering Platform Connection | No Auditing |
| Other Object Access Events | No Auditing |
| Detailed File Share | No Auditing |
| Removable Storage | No Auditing |
| Central Policy Staging | No Auditing |
| Privilege Use | Non Sensitive Privilege Use | Success and Failure |
| Other Privilege Use Events | Success and Failure |
| Sensitive Privilege Use | Success and Failure |
| Detailed Tracking | Process Creation | No Auditing |
| Process Termination | No Auditing |
| DPAPI Activity | No Auditing |
| RPC Events | No Auditing |
| Policy Change | Authentication Policy Change | Success and Failure |
| Authorization Policy Change | Success and Failure |
| MPSSVC Rule-Level Policy Change | Success and Failure |
| Filtering Platform Policy Change | Success and Failure |
| Other Policy Change Events | Success and Failure |
| Audit Policy Change | Success and Failure |
| Account Management | User Account Management | Success and Failure |
| Computer Account Management | Success and Failure |
| Security Group Management | Success and Failure |
| Distribution Group Management | Success and Failure |
| Application Group Management | Success and Failure |
| Other Account Management Events | Success and Failure |
| DS Access | Directory Service Changes | No Auditing |
| Directory Service Replication | No Auditing |
| Detailed Directory Service Replication | No Auditing |
| Directory Service Access | Success |
| Account Logon | Kerberos Service Ticket Operations | Success and Failure |
| Other Account Logon Events | Success and Failure |
| Kerberos Authentication Service | Success and Failure |
| Credential Validation | Success and Failure |
