In an ideal world, you would audit your host against a set of policies and procedures. However, we don't live in an ideal world. Here is a recommended list of items to evaluate. From experience, we know that there are debates around auditing Windows. Can a Windows server be secured? What makes your steps better than some else's steps? The truth is that these steps have worked for several companies, and any auditing program you implement is only going to catch most of the things you could possibly examine.