...
The following link provides additional information: https://msdn.microsoft.com/en-us/library/cc722010.aspx
Note: If the AD machine is configured as the collector then you need to enable audit logs only on the AD machine. If the case is otherwise(any endpoint is configured as the collector), then you need to enable audit logs on each of the computers added in the subscriptions separately.