$ 0 0 It is best turn off at the source via group policy. See guidelines in the KB below SolarWinds Knowledge Base :: Audit Policy and Best Practice