System audit policy was changed

What it means

Auditing settings were changed on the computer.

Why it matters

Turning auditing off blinds your monitoring; attackers do this before acting.

What to do

• Confirm the change came from Group Policy or a planned change.
• Re-apply your audit baseline.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'Security'; Id = 4719
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.