Stopping auditing on a computer
Several actions can directly or indirectly stop auditing on a computer. For example:
- Someone powers down the audited computer.
- Someone logs in on the audited computer and stops the agent.
- The audited computer is moved to a different audit store, causing the initial audit store to consider the audited computer disconnected.
- The administrator checks the Define trusted audited computer list on the Advanced tab of an Audit Store Properties page, and does not include the audited computer on that list.