$ 0 0 Hard one because MSFT is logging it as a change Windows Security Log Event ID 4719 - System audit policy was changed