Auditing Enhancements to AD FS in Windows Server 2016
Currently, in AD FS for Windows Server 2012 R2 there are numerous audit events generated for a single request and the relevant information about a log-in or token issuance activity is either absent (in some versions of AD FS) or spread across multiple audit events. By default the AD FS audit events are turned off due to their verbose nature.
With the release of AD FS in Windows Server 2016, auditing has become more streamlined and less verbose.
Auditing levels in AD FS for Windows Server 2016
By default, AD FS in Windows Server 2016 has basic auditing enabled. With basic auditing, administrators will see 5 or less events for a single request. This marks a significant decrease in the number of events administrators have to look at, in order to see a single request. The auditing level can be raised or lowered using the PowerShell cmdlet: Set-AdfsProperties -AuditLevel. The table below explains the available auditing levels.
| Audit Level | PowerShell syntax | Description |
|---|---|---|
| None | Set-AdfsProperties - AuditLevel None | Auditing is disabled and no events will be logged. |
| Basic (Default) | Set-AdfsProperties - AuditLevel Basic | No more than 5 events will be logged for a single request |
| Verbose | Set-AdfsProperties - AuditLevel Verbose | All events will be logged. This will log a significant amount of information per request. |
To view the current auditing level, you can use the PowerShell cmdlet: Get-AdfsProperties.
The auditing level can be raised or lowered using the PowerShell cmdlet: Set-AdfsProperties -AuditLevel.
Types of Audit Events
AD FS Audit Events can be of different types, based on the different types of requests processed by AD FS. Each type of Audit Event has specific data associated with it. The type of audit events can be differentiated between login requests (i.e. token requests) versus system requests (server-server calls including fetching configuration information).
The table below describes the basic types of audit events.
| Audit Event Type | Event ID | Description |
|---|---|---|
| Fresh Credential Validation Success | 1202 | A request where fresh credentials are validated successfully by the Federation Service. This includes WS-Trust, WS-Federation, SAML-P (first leg to generate SSO) and OAuth Authorize Endpoints. |
| Fresh Credential Validation Error | 1203 | A request where fresh credential validation failed on the Federation Service. This includes WS-Trust, WS-Fed, SAML-P (first leg to generate SSO) and OAuth Authorize Endpoints. |
| Application Token Success | 1200 | A request where a security token is issued successfully by the Federation Service. For WS-Federation, SAML-P this is logged when the request is processed with the SSO artifact. (such as the SSO cookie). |
| Application Token Failure | 1201 | A request where security token issuance failed on the Federation Service. For WS-Federation, SAML-P this is logged when the request was processed with the SSO artifact. (such as the SSO cookie). |
| Password Change Request Success | 1204 | A transaction where the password change request was successfully processed by the Federation Service. |
| Password Change Request Error | 1205 | A transaction where the password change request failed to be processed by the Federation Service. |
| Sign Out Success | 1206 | Describes a successful sign-out request. |
| Sign Out Failure | 1207 | Describes a failed sign-out request. |