Enable security auditing event IDs

Enable required Windows security auditing event IDs.

You can enable security auditing events using GPO or set them up on a local server. Active Directory Certificate Services (ADCS) events require additional setup.

Note

We recommend you configure security auditing using Group Policy Object (GPO). Using GPO simplifies audit management and ensures that auditing settings are uniformly applied across your network, reducing the risk of misconfigurations on individual machines.