Privileged activity report

The default Privileged Activity Report provides a record of all actions taken with elevated privileges for all audited users and computers. The report includes the user name, the computer where the activity occurred, the time at which the activity occurred, and the event recorded. For example, if a user selected a role with administrative privileges, the event would be recorded and included in the report you generate.

You can customize and filter the information included in a Privileged Activity Report by specifying the query criteria and saving the report definition.