Hi There, We have one windows 2008 server joined as member of domain running production services. We noticed someone changed the local security policy. Now we need find out who made the changes and when. I go to windows event log, security, tried to export the log file to csv file, however the event log is too big and more than 700MB which excel is unable to load the entire content. We have enable to audit any activity on this server, so I am asking is there any way I can find the entry for the changes, and what is the event ID for this change by the way? Many thanks for any suggestions