To see the new audit events in Event Viewer
Open the Event Viewer. Click Start, type eventvwr in the Start Search box, and then press ENTER.
If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click continue
In the navigation pane, expand the Windows Logs branch.
Right-click Security, and then click Filter Current Log.
In the Includes/Excludes Event IDs box, type 4600-5500, and then click OK.
Event Viewer displays any events that match the criteria. If you just enabled the audit events, there might be only a few events to view at first.