The following command

systemctl restart auditd

Returns the following error on CentOS

Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only (it is configured to refuse manual start/stop).
See system logs and 'systemctl status auditd.service' for details.

Work around is to use service for the restart

service auditd restart