For Advanced Auditing in Active Administrator 5.1 and up on Windows 2008 domain controllers to work, change tracking must be enabled. Change tracking is enabled by default. When an Auditing Agent is removed from a Windows 2008 domain controller, change tracking is not disabled.
The following two commands are used to enabled and disable change tracking on Windows 2008 domain controllers.
To ENABLE Change Tracking:
auditpol /set /subcategory:"directory service changes" /success:enable
To DISABLE Change Tracking:
auditpol /set /subcategory:"directory service changes" /success:disable