Also a nice thing is to disable logging at all. All you need is the auditpol.exe and a small batch file.
Instead of "MyComputer" you have the use the name of the machine on which you are executing the .bat
If you haven't specified a computer name, the audit on the lokal computer will be disabled
After executing the .bat just check the autitpol.txt whether everything is allright
-----------------------------------------
AuditPol 2.0
AuditPol [\\computer] [/enable | /disable] [/help | /?] [/Category:Option] ...
/Enable = Enable audit (default).
/Disable = Disable audit.
Category = System : System events
Logon : Logon/Logoff events
Object : Object access
Privilege : Use of privileges
Process : Process tracking
Policy : Security policy changes
Sam : SAM changes
Directory : Directory access
Account : Account logon events
Option = Success : Audit success events
Failure : Audit failure events
All : Audit success and failure events
None : Do not audit these events
Samples are as follows:
AUDITPOL \\MyComputer
AUDITPOL \\MyComputer /enable /system:all /object:failure
AUDITPOL \\MyComputer /disable
AUDITPOL /logon:failure /system:all /sam:success /privilege:none
AUDITPOL /HELP | MORE displays Help one screen at a time.
