In User Manager - Policies - Audit,
check both Success and Fail for "System Events" or something similar.
It is a good idea to also audit Logon Events.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.