Go to Advanced Audit Policy Configuration > Audit Policies. You can use the Default Domain Controllers Policy or a dedicated GPO to set these policies.įrom the window that opens, go to Computer Configuration > Policies > Windows Settings > Security Settings and depending on the policy you want to enable, do the following: Open the Group Policy Management Editor from Server Manager > Tools > Group Policy Management.Įxpand the Domain Controllers Organizational Units, right-click Default Domain Controllers Policy, and then select Edit. Log in to the server as Domain Administrator. Modify the Advanced Audit Policies of your domain controller using the following instructions: 4776 - Domain Controller Attempted to Validate Credentials for an Account (NTLM).4763 - Universal Distribution Group Deleted.4758 - Universal Security Group Deleted.4757 - Member Removed from Universal Security Group.4756 - Member Added to Universal Security Group.4753 - Global Distribution Group Deleted.4733 - Member Removed from Local Security Group.4732 - Member Added to Local Security Group.4729 - Member Removed from Global Security Group.4728 - Member Added to Global Security Group.

4662 - An operation was performed on an object.

4624 - An account was successfully logged on.

1203 - The Federation Service failed to validate a new credential.

1202 - The Federation Service validated a new credential.

To enhance threat detection capabilities, Defender for Identity needs the following Windows Events to be configured and collected by Defender for Identity: Relevant Windows Events For Active Directory Federation Services (AD FS) events Incorrect Advanced Audit Policy settings can lead to the required events not being recorded in the Event Log and result in incomplete Defender for Identity coverage.

For the correct events to be audited and included in the Windows Event Log, your domain controllers require accurate Advanced Audit Policy settings. Microsoft Defender for Identity detection relies on specific Windows Event log entries to enhance some detections and provide additional information on who performed specific actions such as NTLM logons, security group modifications, and similar events.

Event id 1000 windows rct3 wild