Please refer the Script for monitor admin actions.
It will give an alert when the below conditions are triggered.
1) Microsoft UAC "requests" for privilege action toward user
2) Usage of the user account with admin rights (in the case of user authenticate with an admin account, or use admin account in a UAC request.
3)To receive an alert when a user accept UAC (or) input admin account in UACuac and to know for which process it was requested and track in audit report this kind of actions to investigate in case of security issue.
Based on the ACTIONS respective EVENT ID's the script will work.
Tested in os: WIN 10, WIN 8, WIN 7
Please refer the wiki guide for how to use the custom monitoring scripts