Disabling command-line auditing
If you have auditing enabled on a computer you are upgrading, you should check whether auditing is configured for individual commands or all user activity. If you have enabled auditing for specific commands, you should temporarily disable auditing on the managed computer before upgrading, then restart the auditing of individual commands after completing the upgrade. If you are auditing all user activity on a managed computer, you do not need to stop the auditing service. There will be a brief interruption while files are replaced, then auditing will continue without requiring you to manually restart it.