Windows EventInformation
Windows Event ID 4612 – LSA: Security Audit Policy Changes
Event ID 4612 fires when Local Security Authority (LSA) audit policy settings are modified, indicating changes to Windows security auditing configuration that affect what events get logged.
