We recommend excluding the 'noisy' event class from your Domain Controllers through the use of an Excluded Account template.
1. Start the ChangeAuditor Client
2. Open the client’s Administration view.
3. Open the Auditing menu.
4. Open the Excluded Accounts page.
5. Add an new Excluded Accounts template. The Excluded Accounts Wizard will appear.
6. Enter an appropriate Template Name.
7. Under Event Class, locate the Event Class you want to exclude from auditing on the Domain Controllers.
8. Click on the event class and the Add button to add the Event CLass to the template.
9. Click the Next button. Do not add any accounts to be excluded.
10. Click the Next button again and add the wildcard '*$' (to exclude computer accounts), and optionally add 'nt authority\*' to exclude the local system accounts. Click the Add button for each Wildcard entry. Additionally you could exclude any additional accounts that from a review of the auditing results that you consider to be 'noise' and not worth auditing.
11. Click the down arrow on the Finish button, and select “Finish and Assign to Agent Configuration”.
12. The Configuration Setup wizard will appear. The new Account Exclusions template will appear in the templates list. Assign the new template to the Configuration that will be applied to the Domain Controllers only.
13. Click Ok.
Now wait fifteen minutes for the agents to refresh their configuration or select all of the Domain Controllers and select Refresh Configuration, either by right clicking on the selected agents or from the tool bar above.