Fine-grained auditing tricks with Vista and Server 2008

Not only is there fine-grained password control, there is also enhanced auditing.

Vista and 2008 now support granular auditing, meaning that instead of a couple large categories you can specify very specific elements to be audited. The advantage here is that instead of turning on Object Access auditing then wading through miles of chaff, you can get something as specific as just network file share usage information, or just account lockouts, or just process creation. To see all your options execute (from an elevated CMD prompt):

auditpol /list /subcategory:*
This will return all the new categories and subcategories.

A good in-depth article, which the above paragraph came from, about it can be found here.