Configure audit policies for Windows event logs
To enhance detections and gather more information on user actions like NTLM logons and security group changes, Microsoft Defender for Identity relies on specific Windows Event log entries. Proper configuration of Advanced Audit Policy settings on your domain controllers is crucial to avoid gaps in the Event Log and incomplete Defender for Identity coverage.
This article describes how to configure your Advanced Audit Policy settings as needed for a Defender for Identity sensor, and other configurations for specific event types.
Defender for Identity generates health issues for each of these scenarios if they're detected. For more information, see Microsoft Defender for Identity health issues.
Prerequisites
- Before running Defender for Identity PowerShell commands, make sure that you downloaded the Defender for Identity PowerShell module.
Generate a report with current configurations via PowerShell
Before you start creating new event and audit policies, we recommend that you run the following PowerShell command to generate a report of your current domain configurations:
New-MDIConfigurationReport [-Path] <String> [-Mode] <String> [-OpenHtmlReport]
Where:
- Path specifies the path to save the reports to
- Mode specifies whether you want to use Domain or LocalMachine mode. In Domain mode, the settings are collected from the Group Policy objects. In LocalMachine mode, the settings are collected from the local machine.
- OpenHtmlReport opens the HTML report after the report is generated
For example, to generate a report and open it in your default browser, run the following command:
New-MDIConfigurationReport -Path "C:\Reports" -Mode Domain -OpenHtmlReport
For more information, see the DefenderforIdentity PowerShell reference.
Tip
The Domain
mode report includes only configurations set as group policies on the domain. If you have settings defined locally on your Domain Controllers, we recommend that you also run the Test-MdiReadiness.ps1 script.
Configure auditing for domain controllers
Update your Advanced Audit Policy settings and extra configurations for specific events and event types, such as users, groups, computers, and more. Audit configurations for domain controllers include:
- Advanced Audit Policy settings
- NTLM auditing
- Domain object auditing
Use the following procedures to configure auditing on the domain controllers you're using with Defender for Identity:
Configure Advanced Audit Policy settings from the UI
This procedure describes how to modify your domain controller's Advanced Audit Policies as needed for Defender for Identity via the UI.
Related health issue: Directory Services Advanced Auditing is not enabled as required
To configure your Advanced Audit Policy settings:
Sign in to the server as Domain Administrator.
Open the Group Policy Management Editor from Server Manager > Tools > Group Policy Management.
Expand the Domain Controllers Organizational Units, right-click Default Domain Controllers Policy, and then select Edit. For example:
Note
Use the Default Domain Controllers Policy or a dedicated GPO to set these policies.
From the window that opens, go to Computer Configuration > Policies > Windows Settings > Security Settings and, depending on the policy you want to enable, do the following:
Go to Advanced Audit Policy Configuration > Audit Policies. For example:
Under Audit Policies, edit each of the following policies and select Configure the following audit events for both Success and Failure events.
Audit policy Subcategory Triggers event IDs Account Logon Audit Credential Validation 4776 Account Management Audit Computer Account Management * 4741, 4743 Account Management Audit Distribution Group Management 4753, 4763 Account Management Audit Security Group Management * 4728, 4729, 4730, 4732, 4733, 4756, 4757, 4758 Account Management Audit User Account Management 4726 DS Access Audit Directory Service Changes 5136 System Audit Security System Extension * 7045 DS Access Audit Directory Service Access 4662 - For this event, you must also configure domain object auditing. Note
* Noted subcategories don't support failure events. However, we recommend adding them for auditing purposes in case they're implemented in the future. For more information, see Audit Computer Account Management, Audit Security Group Management, and Audit Security System Extension.
For example, to configure Audit Security Group Management, under Account Management, double-click Audit Security Group Management, and then select Configure the following audit events for both Success and Failure events:
From an elevated command prompt, enter
gpupdate
.After you apply the policy via GPO, the new events are visible in the Event Viewer, under Windows Logs -> Security.
To test your audit policies from the command line, run the following command:
auditpol.exe /get /category:*
For more information, see auditpol reference documentation.
Configure Advanced Audit Policy settings using PowerShell
This procedure describes how to modify your domain controller's Advanced Audit Policies as needed for Defender for Identity using PowerShell.
Related health issue: Directory Services Advanced Auditing is not enabled as required
To configure your settings, run:
Set-MDIConfiguration [-Mode] <String> [-Configuration] <String[]> [-CreateGpoDisabled] [-SkipGpoLink] [-Force]
Where:
Mode specifies whether you want to use Domain or LocalMachine mode. In Domain mode, the settings are collected from the Group Policy objects. In LocalMachine mode, the settings are collected from the local machine.
Configuration specifies which configuration to set. Use
All
to set all configurations.CreateGpoDisabled specifies if the GPOs are created and kept as disabled.
SkipGpoLink specifies that GPO links aren't created.
Force specifies that the configuration is set or GPOs are created without validating the current state.
To view your audit policies, use the Get-MDIConfiguration command to show current values:
Get-MDIConfiguration [-Mode] <String> [-Configuration] <String[]>
Where:
Mode specifies whether you want to use Domain or LocalMachine mode. In Domain mode, the settings are collected from the Group Policy objects. In LocalMachine mode, the settings are collected from the local machine.
Configuration specifies which configuration to get. Use
All
to get all configurations.
To test your audit polices, use the Test-MDIConfiguration command to get a true
or false
response as to whether the values are configured correctly:
Test-MDIConfiguration [-Mode] <String> [-Configuration] <String[]>
Where:
Mode specifies whether you want to use Domain or LocalMachine mode. In Domain mode, the settings are collected from the Group Policy objects. In LocalMachine mode, the settings are collected from the local machine.
Configuration specifies which configuration to test. Use
All
to test all configurations.
For more information, see the following DefenderForIdentity PowerShell references:
Configure NTLM auditing
This section describes the extra configuration steps needed to audit Event ID 8004.
Note
- Domain group policies to collect Windows Event 8004 should only be applied to domain controllers.
- When Windows Event 8004 is parsed by Defender for Identity Sensor, Defender for Identity NTLM authentications activities are enriched with the server accessed data.
Related health issue:: NTLM Auditing is not enabled
To configure NTLM auditing:
After configuring your initial Advanced Audit Policy settings (UI / PowerShell), open Group Policy Management and go to the Default Domain Controllers Policy > Local Policies > Security Options.
Under Security Options, configure the specified security policies as follows:
Security policy setting Value Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers Audit all Network security: Restrict NTLM: Audit NTLM authentication in this domain Enable all Network security: Restrict NTLM: Audit Incoming NTLM Traffic Enable auditing for all accounts
For example, to configure Outgoing NTLM traffic to remote servers, under Security Options, double-click Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers, and then select Audit all:
Configure domain object auditing
To collect events for object changes, such as event 4662, you must also configure object auditing on the user, group, computer, and other objects. This procedure describes how to enable auditing in the Active Directory domain.
Important
Make sure to review and audit your policies (UI / PowerShell) before enabling event collection to ensure that the domain controllers are properly configured to record the necessary events. If configured properly, this auditing should have minimal effect on server performance.
Related health issue: Directory Services Object Auditing is not enabled as required
To configure domain object auditing:
Go to the Active Directory Users and Computers console.
Select the domain you want to audit.
Select the View menu and select Advanced Features.
Right-click the domain and select Properties. For example:
Go to the Security tab, and select Advanced. For example:
In Advanced Security Settings, select the Auditing tab and then select Add. For example:
Select Select a principal. For example:
Under Enter the object name to select, enter **Everyone, and select Check Names > OK. For example:
You then return to Auditing Entry. Make the following selections:
For Type select Success.
For Applies to select Descendant User objects.
Under Permissions, scroll down and select the Clear all button. For example:
Scroll back up and select Full Control. All the permissions are selected.
Clear the selection for the List contents, Read all properties, and Read permissions permissions, and select OK. This sets all the Properties settings to Write. For example:
Now, when triggered, all relevant changes to directory services appear as
4662
events.
Repeat the steps in this procedure, but for Applies to, select the following object types:
- Descendant Group Objects
- Descendant Computer Objects
- Descendant msDS-GroupManagedServiceAccount Objects
- Descendant msDS-ManagedServiceAccount Objects
Note
Assigning the auditing permissions on the All descendant objects would work as well, but we only require the object types as detailed in the last step.
Configure auditing on an Active Directory Federation Services (AD FS)
Related health issue: Auditing on the ADFS container is not enabled as required
To configure auditing on an Active Directory Federation Services (AD FS):
Go to the Active Directory Users and Computers console, and select the domain you want to enable the logs on.
Go to Program Data > Microsoft > ADFS. For example:
Right-click ADFS and select Properties.
Go to the Security tab and select Advanced > Advanced Security Settings > Auditing tab > Add > Select a principal.
Under Enter the object name to select, enter Everyone.
Select Check Names > OK.
You then return to Auditing Entry. Make the following selections:
- For Type select All.
- For Applies to select This object and all descendant objects.
- Under Permissions, scroll down and select Clear all. Scroll up and select Read all properties and Write all properties.
For example:
Select OK.
Configure auditing for Active Directory Certificate Services (AD CS)
If you're working with a dedicated server with Active Directory Certificate Services (AD CS) configured, make sure to configure auditing as follows to view dedicated alerts and Secure Score reports.
Create a group policy to apply to your AD CS server. Edit it and configure the following auditing settings:
Go to Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Certification Services.
Select to configure audit events for Success and Failure. For example:
Configure auditing on the certificate authority (CA) using one of the following methods:
- To configure CA auditing using the command line, run:
certutil –setreg CA\AuditFilter 127 net stop certsvc && net start certsvc
- To Configure CA auditing using the GUI:
Select Start -> Certification Authority (MMC Desktop application). Right-click your CA's name and select Properties. For example:
Select the Auditing tab, select all the events you want to audit, and then select Apply. For example:
Note
Configuring Start and Stop Active Directory Certificate Services event auditing may cause restart delays when dealing with a large AD CS database. Consider removing irrelevant entries from the database, or alternatively, refrain from enabling this specific type of event.
Configure auditing for Entra Connect
To configure auditing on Entra Connect servers:
Create a group policy to apply to your Microsoft Entra Connect servers. Edit it and configure the following auditing settings:
Go to Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon.
Select to configure audit events for Success and Failure. For example:
Configure auditing on the configuration container
Related health issue: Auditing on the Configuration container is not enabled as required
Open ADSI Edit by selecting Start > Run. Enter
ADSIEdit.msc
and select OK.On the Action menu, select Connect to.
In the Connection Settings dialog box under Select a well known Naming Context, select Configuration > OK.
Expand the Configuration container to show the Configuration node, beginning with “CN=Configuration,DC=..."
Right-click the Configuration node and select Properties. For example:
Select the Security tab > Advanced.
In the Advanced Security Settings, select the Auditing tab > Add.
Select Select a principal.
Under Enter the object name to select, enter **Everyone, and select Check Names > OK.
You then return to Auditing Entry. Make the following selections:
- For Type select All.
- For Applies to select This object and all descendant objects.
- Under Permissions, scroll down and select Clear all. Scroll up and select Write all properties.
For example:
Select OK.
Legacy configurations
Important
Defender for Identity no longer requires logging 1644 events. If you have this registry setting enabled, you can remove it.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics]
"15 Field Engineering"=dword:00000005
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters]
"Expensive Search Results Threshold"=dword:00000001
"Inefficient Search Results Threshold"=dword:00000001
"Search Time Threshold (msecs)"=dword:00000001
Related content
For more information, see:
- What is Windows event collection for Defender for Identity
- Windows security auditing
- Advanced security audit policies