If you find it annoying that your security event log is populated with literally thousands of entries telling you that the system has successfully done something, keep reading. Open 'Local Group Policy Editor' - you will need Administrative rights to make these changes . - Start > Run > gpedit.msc (or secpol.msc which brings you directly to ' Security Settings ') Or, navigate to Administrative Tools and open Local Security Policy from there. In Local Group Policy Editor, under Local Computer Policy, navigate to: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object For reference: Now, go to 'Account Management' and open 'Audit User Account Management' Open this setting and tic the box to 'Configure the following...' as well as 'Failure'. Click OK. While here, do the same for '...