4624, 4625, 4634 for logon activity 4720 / 4726 / 4738 account lifecycle 4728 / 4732 / 4756 group membership 4740 lockouts 4672 special privileges, your admin logon signal 1102 log cleared, this one should page somebody 4688 process creation if you can afford it, and turn on command line auditing or it is half useless
4688 is the expensive one and the most useful. Servers first, see what it costs, then decide about workstations.
4624, 4625, 4634 for logon activity
4720 / 4726 / 4738 account lifecycle
4728 / 4732 / 4756 group membership
4740 lockouts
4672 special privileges, your admin logon signal
1102 log cleared, this one should page somebody
4688 process creation if you can afford it, and turn on command line auditing or it is half useless
4688 is the expensive one and the most useful. Servers first, see what it costs, then decide about workstations.