Monitor changes to your GPO settings

Group Policy Object (GPO) settings should only be accessed by IT admins. Any unauthorized changes to these settings indicate a security breach. Tracking all changes to your GPO settings by defining the Audit Directory Service Access and Audit Directory Service Changes policies results in a more secure network.Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies/DS Access