Link the new GPO to OU with User Accounts → Go to 'Group Policy Management' → Right-click the defined OU → Choose 'Link an Existing GPO' → Choose the GPO that you’ve created.Retention method for security log to Overwrite events as needed.Audit account management → Define → Success.Run gpedit.msc → Create a new GPO → Edit it → Go to 'Computer Configuration' → Policies → Windows Settings → Security Settings → Local Policies > Audit Policy:.How to Detect Who Disabled a User Account in Active Directory.
