# How to disable audit reporting on Windows 8.1

On a multi-user Windows 8.1 development machine, there have been many slowdowns when accessing via RDP. In reviewing the event viewer, I noticed that there are many audits running in the security section, which seem excessive and unnecessary: every few seconds, dozens of events are generated:

I have tried changing the local security policy, but it seems to already be disabled:

So, how do I disable the auditing? Or should it be a concern?

• This can be done by an Administrator domain user. – Ramhound Mar 3 '15 at 19:29
• I right click and ran as administrator the local security policy (secpol.msc) as a local account Administrator. All accounts on this machine are local accounts. – Jake Mar 3 '15 at 19:34

The Local Security Policy UI lies to you about certain audited activities. (There are actually several activities involved in each of those categories; it generalizes.) To see exactly what is audited, run auditpol /get /category:* at an administrative command prompt. To fully disable auditing, run auditpol /clear, then reboot.
You can back up and restore the audit policy (if you think somebody legitimately and purposefully set up a custom policy) using the /backup and /restore switches on auditpol, both of which require a /file:"\path\to\file" argument immediately following.