| Events to Audit | Description |
| Query Value | Reads a value entry from a Registry key |
| Set Value | Sets value entries in a Registry key |
| Create Subkey | Create subkeys on a selected Registry key |
| Enumerate Subkeys | Audits events that attempt to identify the subkeys of a Registry key such as expanding the tree view |
| Notify | Notifies events from a ket in the Registry |
| Create link | Creates a symbolic link in a particular key |
| Delete | Deletes a Registry object |
| Write DAC | Changes security permissions on a key |
| Read Control | Reads the security permissions of a key |
