Daily Defender News
Aboutmerill.net
Microsoft Defender for Identity
Identity protection

Configure Windows event auditing

4 September 2026Feature update+37 / −25 lines

In brief

The documentation now describes automatic Windows event auditing for sensor v3.x on domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers. Sensor v2.x and opted-out v3.x deployments still require manual configuration. AD CS requires an existing CA audit filter.

What Defender admins need to know

Administrators deploying sensor v3.x on these server types can use automatic auditing; verify that an AD CS audit filter already exists.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure Windows event auditing

Configure auditing using one of these methods:

Configure Defender for Identity to collect Windows events automatically

If you're deploying the Defender for Identity sensor v3.x on domain controllers,x, use automatic Windows auditing. This is the recommended approach; itapproach requires no manual configuration and handles all auditing settings for you.

Turn on automatic Windows auditing

To enable automatic Windows auditing in the Defender portal, complete the following steps:

  1. In the Microsoft Defender portal, go to Settings, and then Identities.
  2. In the General section, select Advanced features.
  3. Turn on Automatic Windows auditing configuration.
    • Directory services advanced auditing: Adds audit entries to the domain root object's System Access Control List (SACL) to enable required directory service auditing.
    • NTLM auditing: Uses standard Windows Registry APIs to configure the required NTLM auditing registry values.
    • Domain object auditing: Modifies the SACL on the Configuration partition to capture changes to directory service configuration objects.
    • ADFSAD FS auditing: Automatically configures the following settings:
      • Object-level auditing on the AD FS configuration container: Adds audit entries to the object's System Access Control List (SACL) of the AD FS configuration container, to enable auditing of AD FS-related directory objects.
      • Group Policy for event auditing: Configures the Audit Application Generated advanced audit policy (Success and Failure) on the local system by using the Windows Local Security Authority (LSA) audit policy APIs under the sensor's local system account.
      • Other AD FS auditing settings aren't included in automatic auditing and remain manual, such as AD FS event auditing in AD FS Management and verbose logging for AD FS events.
    • AD CS auditing: Writes the required value to the certificate authority (CA) audit filter in the CA's registry configuration. Automatic auditing modifies an existing audit filter but doesn't create one, so the CA must already have an audit filter configured. The new value takes effect after the Certificate Services (certsvc) service restarts. Until the service restarts, Defender for Identity raises a health alert that prompts you to restart it.
    • Microsoft Entra Connect auditing: Configures the Audit Logon advanced audit policy (Success and Failure) on Microsoft Entra Connect servers by using the Windows LSA audit policy APIs.
    • Windows audit policy: Configures the local Windows audit policies using the Windows Local Security Authority (LSA)LSA audit policy APIs.
  • Applies auditing settings directly to the local system policy of the domain controller.
  • Sends health alerts about the configuration state.server.
  • Runs once every 24 hours.

Configure Windows event collection manually

This section includes instructions for manually configuring Windows event collection. Use these steps if you're deploying sensor v2.x, deploying on AD FS, AD CS, or Entra Connect servers that aren't domain controllers,x or if you opted out of automatic auditing for sensor v3.x.

The following sections describe configuration for each server type:

Configure Directory Services Advanced Auditing

The following procedure describes how to modify your domain controller's Audit (Premium) Policy settings for Defender for Identity.

  1. Sign in to the server as Domain Administrator.
  2. Open the Group Policy Management Editor from Server Manager > Tools > Group Policy Management. | Audit policy | Subcategory | Triggers event IDs | | --- |---|---| | Account Logon | Audit Credential Validation | 4776 | | Account Management | Audit Computer Account ManagementFailure auditing note | 4741, 4743 | | Account Management | Audit Distribution Group ManagementFailure auditing note | 4753, 4763 | | Account Management | Audit Security Group ManagementFailure auditing note | 4728, 4729, 4730, 4732, 4733, 4756, 4757, 4758 | | Account Management | Audit User Account Management | 4726 | | DS Access | Audit Directory Service ChangesSee note | 5136 | | System | Audit Security System ExtensionSee note | 7045 |

Configure Object-level auditing on the AD FS configuration folder

To configure object-level auditing on the AD FS configuration folder, complete the following steps:

  1. Go to the Active Directory Users and Computers console, and select the domain where you want to enable the logs.
  2. Go to Program Data > Microsoft > ADFS.

Configure auditing on an AD FS server

This sectionThe following procedure describes how to modify your Active Directory Federation Services (AD FS) audit configurations for Defender for Identity.

Configure a Group Policy for event auditing

To configure Group Policy-based event auditing for AD FS, complete the following steps:

  1. Create a group policy to apply to your Active Directory Federation Services (AD FS).
  2. Configure the following auditing settings:

Configure AD FS event auditing in AD FS Management

To enable AD FS event auditing in AD FS Management, complete the following steps:

  1. Select Start > Programs > Administrative Tools > AD FS Management.

  2. Go to Actions > Edit Federation Service Properties.

  3. Select the Events tab.

  4. Configure auditing on the certificate authority (CA) using one of the following methods:

    • To configure CA auditing using PowerShell, run:PowerShell, set the CA audit filter to enable full auditing and then restart the Certificate Services service for the change to take effect:
certutil -setreg CA\AuditFilter 127
Restart-Service certsvc

This command updates the CA audit settings and restarts the Certificate Services service so the changes take effect.

  • To configure CA auditing in the Defender portal:

    1. Select Start > Certification Authority (MMC Desktop application). Right-click your CA's name and select Properties.

To configure auditing on Microsoft Entra Connect servers:

  1. Create a group policy to apply to your Microsoft Entra Connect servers.

  2. Edit the group policy and configure the following auditing settings:

    1. Go to Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon.

You need the configuration container audit only for environments that currently have or previously had Microsoft Exchange. These environments have an Exchange container located within the domain's Configuration section.

Active Directory replicates the configuration container throughout the forest, so configure auditing once for the entire forest. The health alert might appear for multiple domains because sensors in each domain report the state of the shared configuration container.

  1. Open the ADSI Edit tool.
  2. Select Start > Run, enter ADSIEdit.msc, and then select OK.
  3. In the Action menu, select Connect to.

To view your audit policies:

Use the Get-MDIConfiguration cmdlet to retrieve the current Defender for Identity configuration values in domain or local machine mode:mode. Use the following syntax to view the current configuration for a specific mode and configuration set:

Get-MDIConfiguration [-Mode] <String> [-Configuration] <String[]>

**To configure your settings:**

Use the following syntax to apply one or more Defender for Identity configurations in domain or local machine mode:configuration settings and optionally control GPO creation and linking behavior:

```powershell
Set-MDIConfiguration [-Mode] <String> [-Configuration] <String[]> [-CreateGpoDisabled] [-SkipGpoLink] [-Force]
- `SkipGpoLink` specifies that GPO links aren't created.
- `Force` specifies that the configuration is set or GPOs are created without validating the current state.

The following example applies the full recommendedall supported Defender for Identity domain configuration set through Group Policysettings in domain mode, createsone operation, creating the group policy objects,objects and linkslinking them:

```powershell
Set-MDIConfiguration -Mode Domain -Configuration All