1.3.17 Audit Policy: Account Management: User Account Management
Information
This control defines whether the audit is activated when a user account management event, such as a create, change, rename, delete, disable or enable event occurs.
Solution
Make sure 'Audit Policy: Account Management: User Account Management' is configured to Success (minumum).