diff --git a/rules/windows/builtin/win_disable_event_logging.yml b/rules/windows/builtin/win_disable_event_logging.yml
index 52ef34e3f..e1ea29ef1 100644
--- a/rules/windows/builtin/win_disable_event_logging.yml
+++ b/rules/windows/builtin/win_disable_event_logging.yml
@@ -16,7 +16,9 @@ logsource:
 detection:
     selection:
         EventID: 4719
-        AuditPolicyChanges: 'removed'
+        AuditPolicyChanges|contains:
+            - '%%8448' # This is "Success removed"
+            - '%%8450' # This is "Failure removed" 
     condition: selection
 falsepositives:
     - Unknown