Config Windows Windows Ultimate Security Baseline Audit Policy

Recommended Baseline Audit Policy for Windows Server 2008

If you enable too wide an audit policy you will be innundated with "noise" events. I recommend starting with this and tweaking from there. This policy turns off the worst offenders and other categories whose events aren't typically worth much.

Before using this recommendation make sure you review my article on auditpol and its related articles as well!