Audit Policy: Policy Change: Authorization Policy Change
This subcategory reports changes in authorization policy including permissions (DACL) changes. Events for this subcategory include:
? 4704: A user right was assigned.
? 4705: A user right was removed.
? 4706: A new trust was created to a domain.
? 4707: A trust to a domain was removed.
? 4714: Encrypted data recovery policy was changed.
R ...