#define STATUS_AUDITING_DISABLED ((NTSTATUS)0xC0000356L)
MessageId: STATUS_AUDITING_DISABLED MessageText: The specified event is currently not being audited.