Windows EventInformation
Windows Event ID 4963 – Microsoft-Windows-Security-Auditing: Object Access Auditing Disabled
Event ID 4963 indicates that object access auditing has been disabled on a Windows system. This security event fires when audit policies for file, folder, or registry access monitoring are turned off.
