Active Directory auditing: advanced audit policy and the events worth watching
After an incident, the first question is always the same: what happened, and since when? Without proper logging on domain controllers, the answer is often "we don't know". The default audit configuration is not enough.
Advanced audit policy, not basic
Windows offers two sets of settings: the nine categories of the basic audit policy and the fifty or so subcategories of the advanced policy. Mixing them produces unpredictable results. Configure only the advanced policy, in a GPO linked to the Domain Controllers OU, and enable "Force audit policy subcategory settings" so it overrides the basic policy.
Check the result on a domain controller with auditpol /get /category:*.
Essential subcategories
- Account Logon: Kerberos Authentication Service, Kerberos Service Ticket Operations, Credential Validation.
- Account Management: User, Computer and Security Group Management.
- DS Access: Directory Service Access and Directory Service Changes, both of which also need SACLs on objects.
- Logon/Logoff: Logon, Special Logon, Account Lockout.
- Policy Change and Privilege Use as needed.
Key events
| ID | Meaning |
|---|---|
| 4624 / 4625 | Successful / failed logon |
| 4672 | Special privileges assigned to a logon (admin account) |
| 4720 | User account created |
| 4728 / 4732 / 4756 | Member added to a global / local / universal group |
| 4738 | User account changed |
| 4769 | Kerberos service ticket requested |
| 4662 | Operation performed on a directory object |
| 5136 | Directory object modified (with old and new value) |
Log size and centralisation
On a busy domain controller, the Security log can roll over within hours if its size has not been increased. Size it according to actual volume and, above all, do not rely on local retention: an attacker with admin rights can clear the log (event 1102).
Centralise with Windows Event Forwarding or the SIEM agent. This guarantees retention, enables correlation across domain controllers and sets retention according to your compliance obligations.
Advice. Ten well-tuned alert rules that someone actually follows up are worth more than a SIEM that receives everything and triggers nothing. Start with rare, high-impact changes.
What to alert on
- A member added to a privileged group (4728, 4732, 4756 on Domain Admins, Enterprise Admins, Administrators, Operators groups, DnsAdmins).
- Event 4662 carrying replication GUIDs, from an account that is not a domain controller.
- Changes (5136) to GPOs linked to domain controllers, to the AdminSDHolder object or to the domain root ACL.
- Unusual volumes of 4769 requests using RC4 encryption, a possible sign of Kerberoasting.
- Log clearing (1102) and spikes in authentication failures (4625, 4771).
What an audit checks
- The effective advanced audit policy on each domain controller.
- SACLs on the domain root and sensitive objects.
- Log sizes and forwarding to a central platform.
- Alert rules on critical events.