TABLE 1: Audit account management Event IDs for Specific Actions
Object Created Deleted Changed Member Added Member Removed
User 624 630 642 N/A N/A
Computer 645 646 647 N/A N/A
Local group 635 638 639 636 637
Global group 631 634 641 632 633
Universal group 658 662 659 660 661