I want to audit registry related events (modify key delete key etc) , so i enabled it via group policy and setup a "Global Object Access Auditing" for auditing on "Authenticated Users". Unfortunately the event count it too high and almost 95% of them are from "NT SYSTEM". Below are my questions;
-> Why is "NT SYSTEM" part of "Authenticated Users"? -> What should i select in the "Global Object Access Auditing", which limits auditing to all interactive and non interactive users except SYSTEM.?
Edit: If i were to use, "Domain Users" i need to create seperate entry for each domain in the forest and out fo forest; i am wishing, it were to be last resort move.