 .must have the SeAuditPrivilege privilege to successfully generate an audit record".The Winzapper FAQ notes that it is "possible to add your own 'made up' event records to the log" but this feature was not added because it was considered "too nasty," a reference to the fact that someone with Administrator access could use such functionality to shift the blame for unauthorized activity to an innocent party.