Stopping auditing on a computer

Several actions can directly or indirectly stop auditing on a computer. For example:

  • Someone powers down the audited computer.
  • Someone logs in on the audited computer and stops the agent.
  • The audited computer is moved to a different audit store, causing the initial audit store to consider the audited computer disconnected.
  • The administrator checks the Define trusted audited computer list on the Advanced tab of an Audit Store Properties page, and does not include the audited computer on that list.