An Interesting question came up at work this week. That was
How do you Audit the fact that someone has modified a Group Policy ?
Well the general concensus was the following;
Check out the following excellent blog article
Windows Security Logging and Other Esoterica : Monitoring Group Policy Changes with Windows Auditing
Useful and excellent article on exactly what settings to Audit .
But also 3rd party tools have a part to play here, such as Quest and Netpro.