Stopping auditing on a computer

Several actions can directly or indirectly stop auditing on a computer. For example:

• Someone powers down the audited computer.
• Someone logs in on the audited computer and stops the agent.
• The audited computer is moved to a different audit store, causing the initial audit store to consider the audited computer disconnected.
• The administrator checks the Define trusted audited computer list on the Advanced tab of an Audit Store Properties page, and does not include the audited computer on that list.