Logging authentication events

Question

I use Active Directory on Windows server 2012 R2 Standard. We have over 700 clients through out our company that connects to AD. I would like to start logging authentication events in all of our systems. I need to be able to track when our admin accounts are being used. If we get attacked, I want to be able to look through a log to see where they've been. Would anyone have some feedback on how I can go about doing this. Your feedback would be greatly appreciated.

Answer 1

Hello @Madman2112 ,

Thank you for posting here.

We can configure the audit policy setting as below.

GPO: Default Domain Policy

Legacy audit policy:

Computer Configuration\Windows settings\security settings\local policies\audit policy
Audit Logon Events – Successs and Failure

OR use advanced audit policies (advanced audit policies will overwrite traditional audit policies by default):
Computer Configuration\Windows settings\security settings\Advanced Audit Policy Configuration
Logon/Logoff: Audit Logon – SUccess and Failure

After that we can update GPO on clients.

When any account are logged on one clients, we can check the 2624 (successful log on ) and 4625 (failed log on) through Security logs in Event Viewer.

References
4625(F): An account failed to log on.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

4624(S): An account was successfully logged on.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

Best Regards,
Daisy Zhou