Auditing And Only Auditing

Below are the references & event id associated with windows Vista, 7,  2008 & 2008 R2.

Description of security events in Windows Vista and in Windows Server 2008

http://support.microsoft.com/?kbid=947226

Security audit events for Microsoft Windows Server 2008 and Microsoft Windows Vista

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=82e6d48f-e843-40ed-8b10-b3b716f6b51b

Description of security events in Windows 7 and in Windows Server 2008 R2

http://support.microsoft.com/kb/977519

Security Audit Events for Windows 7 and Windows Server 2008 R2

http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=3a15b562-4650-4298-9745-d9b261f35814

Advanced Security Auditing in Windows 7 and Windows Server 2008 R2

http://social.technet.microsoft.com/wiki/contents/articles/advanced-security-auditing-in-windows-7-and-windows-server-2008-r2.aspx

Jorge has documented best material on auditing, must take a look to his site.

http://blogs.dirteam.com/blogs/jorge/archive/2008/04/29/auditing-in-windows-server-2008.aspx