{"id":54428,"date":"2023-10-02T09:20:01","date_gmt":"2023-10-02T09:20:01","guid":{"rendered":"https:\/\/infrasos.com\/?p=54428"},"modified":"2023-10-02T09:20:03","modified_gmt":"2023-10-02T09:20:03","slug":"how-to-monitor-and-audit-your-windows-server-for-security-events","status":"publish","type":"post","link":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/","title":{"rendered":"How to Monitor and Audit Your Windows Server for Security Events"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"54428\" class=\"elementor elementor-54428\">\n\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-1538e5c e-con-boxed e-con\" data-id=\"1538e5c\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3d597d5 elementor-widget elementor-widget-text-editor\" data-id=\"3d597d5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>How to Monitor and Audit Your Windows Server for Security Events. In the dynamic landscape of IT infrastructure, safeguarding the integrity and Security of our Windows Server environment is paramount. Effective monitoring and auditing are not just proactive measures. They are the vigilant guardians that ensure the resilience of our system against <a href=\"https:\/\/infrasos.com\/the-role-of-threat-intelligence-in-active-directory-security\/\">potential threats and unauthorized access<\/a>. This article explores the essential elements of monitoring and auditing in Windows Server, offering valuable insights into the necessary tools and practices for recognizing and addressing security events. In doing so, it strengthens the digital defenses of our server environment.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1d3b9ae e-con-boxed e-con\" data-id=\"1d3b9ae\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-15f38b7 elementor-widget elementor-widget-text-editor\" data-id=\"15f38b7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/windows-server-security-best-practices-secure-your-windows-server-environment\/\">Windows Server Security Best Practices: Secure Your Windows Server Environment<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd38e2c elementor-widget elementor-widget-heading\" data-id=\"fd38e2c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-large\">How to Monitor and Audit Your Windows Server for Security Events<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-2967b0c e-con-boxed e-con\" data-id=\"2967b0c\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1997e8e elementor-widget elementor-widget-image\" data-id=\"1997e8e\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/Untitled-2-3.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"How to Monitor and Audit Your Windows Server for Security Events\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ0MzYsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA5XC9VbnRpdGxlZC0yLTMucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Untitled-2-3-qd9bof93l04u89lkcwiyw4hlta3zmhmubx88ekvb12.png\" title=\"How to Monitor and Audit Your Windows Server for Security Events\" alt=\"How to Monitor and Audit Your Windows Server for Security Events\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-f00f4e3 e-con-boxed e-con\" data-id=\"f00f4e3\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-22ad384 elementor-widget elementor-widget-text-editor\" data-id=\"22ad384\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">Every system in an organization&#8217;s network generates log files of some type. Managing and monitoring these log data is crucial to spotting issues that occur within the network. The logs serve as a preliminary source of forensic evidence in case of a mishap. Besides this, <a href=\"https:\/\/infrasos.com\/view-active-directory-ad-event-logs-and-what-they-track\/\">monitoring logs<\/a> also help fulfill <a href=\"https:\/\/infrasos.com\/iso-27001-compliance-checklist-audit-requirements\/\">compliance requirements<\/a>. <a href=\"https:\/\/infrasos.com\/active-directory-reporting\/\">Active Directory<\/a> (AD), most enterprises&#8217; identity <a href=\"https:\/\/infrasos.com\/top-10-best-iam-tools-identity-access-management\/\">access management<\/a> and governance platform, must be monitored regularly. The events that occur in an AD environment (Windows platform) are classified and logged under three main categories:<\/span><\/p><ul><li><span data-preserver-spaces=\"true\">Application logs.<\/span><\/li><li><span data-preserver-spaces=\"true\">System logs.<\/span><\/li><li><span data-preserver-spaces=\"true\"><a href=\"https:\/\/infrasos.com\/analyze-azure-ad-security-logs-audit-monitor-azure-ad-activity\/\">Security logs<\/a>.<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-321e383 e-con-boxed e-con\" data-id=\"321e383\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-34a8921 elementor-widget elementor-widget-text-editor\" data-id=\"34a8921\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Security logs include details about events like <a href=\"https:\/\/infrasos.com\/active-directory-reporting\/user-reports\/last-logon-report\/\">user account logons<\/a> and <a href=\"https:\/\/infrasos.com\/active-directory-reporting\/user-reports\/logon-logoff-report\/\">logoffs<\/a>, modifications to privileged groups, creating, deleting, or modifying scheduled tasks, etc. These logs are one of the first forensic evidence we inspect in case of a mishap to make a timeline and trace the attack path. Consistently monitoring security events and analysing logs helps network administrators to gain insights about <a href=\"https:\/\/infrasos.com\/how-to-protect-windows-server-malware-ransomware-ddos-attacks-other-threats\/\">potential attacks that threaten<\/a>\u00a0the organization&#8217;s IT infrastructure and improve the security posture.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0a2423d e-con-boxed e-con\" data-id=\"0a2423d\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-848e704 elementor-widget elementor-widget-text-editor\" data-id=\"848e704\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/windows-server-hardening-configure-security-settings-policies-for-windows-server\/\">Windows Server Hardening: Configure Security Settings &amp; Policies for Windows Server<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4fd5112 elementor-widget elementor-widget-heading\" data-id=\"4fd5112\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Different Types of Security Event Logs<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0ccbb4e e-con-boxed e-con\" data-id=\"0ccbb4e\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f51f789 elementor-widget elementor-widget-text-editor\" data-id=\"f51f789\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In digital security, understanding the nuances of various event logs is paramount. This segment delves into the categories\u2014from authentication to <a href=\"https:\/\/infrasos.com\/get-azureadauditsigninlogs-find-sign-in-logs-for-last-30-days-with-powershell\/\">audit logs<\/a>\u2014essential for monitoring and safeguarding system integrity. Explore how each log type contributes to a comprehensive view of the security landscape and <a href=\"https:\/\/infrasos.com\/top-10-best-threat-hunting-tools-in-cyber-security\/\">reinforces your cyber security strategy<\/a>. For this article, we are focusing more on Security Logs. The following events are some of the essential security events that we start monitoring in our environment:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-2a9a1b7 e-con-boxed e-con\" data-id=\"2a9a1b7\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8431359 elementor-widget elementor-widget-heading\" data-id=\"8431359\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">User Logon Events<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9491d0f e-con-boxed e-con\" data-id=\"9491d0f\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-022cde4 elementor-widget elementor-widget-text-editor\" data-id=\"022cde4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">Monitoring<a href=\"https:\/\/infrasos.com\/active-directory-reporting\/user-reports\/last-logon-report\/\"> user logon events is essential to determine which users were active<\/a> at any given time. In the event of a breach, identifying specific users accessing network resources are a great place to begin an investigation. Below are some of the Windows event log IDs related to user logon events:<\/span><\/p><ul><li style=\"list-style-type: none;\"><ul><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Logon Failures<\/strong> \u2013 <a href=\"https:\/\/infrasos.com\/what-is-event-id-4771-kerberos-pre-authentication-failed\/\">Event ID 4771<\/a><\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Successful logons<\/strong> \u2013 <a href=\"https:\/\/infrasos.com\/what-is-windows-event-id-4624-successful-logon-2\/\">Event ID 4624<\/a><\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Failures caused by bad passwords<\/strong> \u2013 <a href=\"https:\/\/infrasos.com\/what-is-event-id-4625-an-account-failed-to-log-on\/\">Event ID 4625<\/a><\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-51b8c99 e-con-boxed e-con\" data-id=\"51b8c99\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-690ddd4 elementor-widget elementor-widget-heading\" data-id=\"690ddd4\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">User Attribute Changes<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-33f05db e-con-boxed e-con\" data-id=\"33f05db\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e2b365e elementor-widget elementor-widget-text-editor\" data-id=\"e2b365e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">It is vital to keep a check on changes made to user attributes. Unauthorized changes to user properties could be a precursor to account compromise or <a href=\"https:\/\/infrasos.com\/how-to-secure-active-directory-against-insider-threats\/\">insider attacks<\/a>. Below are some of the event IDs associated with critical change events:<\/span><\/p><ul><li style=\"list-style-type: none;\"><ul><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>User changed the password<\/strong> \u2013 Event ID 4723<\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>User account was changed<\/strong> &#8211; Event ID 4738<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5e54ae8 e-con-boxed e-con\" data-id=\"5e54ae8\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9fe769f elementor-widget elementor-widget-heading\" data-id=\"9fe769f\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Account Lockout Events<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-01e3960 e-con-boxed e-con\" data-id=\"01e3960\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-663214a elementor-widget elementor-widget-text-editor\" data-id=\"663214a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">Solving employees&#8217; account lockout issues is one of the everyday tasks IT administrators perform. Auditing account lockout events help to identify the reason for lockouts and help in swiftly resolving the issue. Below are some of the event IDs associated with account lockout events:<\/span><\/p><ul><li style=\"list-style-type: none;\"><ul><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>User Account Locked Out<\/strong> \u2013 <a href=\"https:\/\/infrasos.com\/what-is-windows-event-log-id-4740-a-user-account-was-locked-out\/\">Event ID 4740<\/a><\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>User Account Unlocked<\/strong> \u2013 Event ID 4767<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ccfa0a2 e-con-boxed e-con\" data-id=\"ccfa0a2\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-06f0222 elementor-widget elementor-widget-text-editor\" data-id=\"06f0222\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/active-directory-reporting\/user-reports\/\">Try InfraSOS Active Directory User Reports<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a3c349a elementor-widget elementor-widget-heading\" data-id=\"a3c349a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Group Management Events<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c6e487a e-con-boxed e-con\" data-id=\"c6e487a\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4f72dc0 elementor-widget elementor-widget-text-editor\" data-id=\"4f72dc0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">Tracking <a href=\"https:\/\/infrasos.com\/active-directory-reporting\/group-reports\/\">Active Directory group membership<\/a> changes is crucial to identify unauthorized access to resources and privilege escalations. Malicious changes made to groups disrupt the functioning of an organization as users might lose access to the resources they require to work efficiently. Below are some of the event IDs associated with critical group change events:<\/span><\/p><ul><li style=\"list-style-type: none;\"><ul><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>User Added to a Privileged Group<\/strong> \u2013 Event ID 4728, 4732, 4756<\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Member added to a standard group<\/strong> \u2013 Event ID 4728, 4732, 4756, 4761, 4746, 4751<\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Member removed from the group<\/strong> \u2013 Event ID 4729, 4733, 4757, 4762, 4747, 4752<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-32bb735 e-con-boxed e-con\" data-id=\"32bb735\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-25e5238 elementor-widget elementor-widget-heading\" data-id=\"25e5238\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Group Policy Object Changes<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-3e46f85 e-con-boxed e-con\" data-id=\"3e46f85\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9c70669 elementor-widget elementor-widget-text-editor\" data-id=\"9c70669\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\"><a href=\"https:\/\/infrasos.com\/create-active-directory-policy-reports-with-powershell\/\">Group Policy Object (GPO)<\/a> provides an integrated platform for configuring and managing user settings, applications, and operating systems in an <a href=\"https:\/\/infrasos.com\/active-directory-reporting\/\">Active Directory environment<\/a>. Keeping a close eye on critical policy changes like account lockout and <a href=\"https:\/\/infrasos.com\/how-to-setup-and-manage-active-directory-password-policy\/\">password policy changes<\/a> is essential to instantly detect and respond to malicious activities. Below are some of the event IDs associated with critical GPO change events:<\/span><\/p><ul><li style=\"list-style-type: none;\"><ul><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Group Policy changes<\/strong> &#8211; Event ID 5136<\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Creation of GPOs<\/strong> &#8211; Event ID 5137<\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>GPO deletions<\/strong> &#8211; Event ID 5141<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-414f206 e-con-boxed e-con\" data-id=\"414f206\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4c1131c elementor-widget elementor-widget-heading\" data-id=\"4c1131c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-large\">Privileged User Activities<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-560c567 e-con-boxed e-con\" data-id=\"560c567\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3968e5e elementor-widget elementor-widget-text-editor\" data-id=\"3968e5e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">Monitoring privileged users&#8217; activities may enable an organization to protect critical assets, spot anomalous activities, and mitigate external and insider threats. Below are some of the event IDs associated with critical privileged user activity events:<\/span><\/p><ul><li style=\"list-style-type: none;\"><ul><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Directory service object was modified<\/strong> &#8211; Event ID 5236<\/span><\/li><li class=\"ql-indent-1\"><span data-preserver-spaces=\"true\"><strong>Attempt to <a href=\"https:\/\/infrasos.com\/sspr-enable-azure-active-directory-self-service-password-reset\/\">reset an account password<\/a><\/strong> &#8211; Event ID 4724<\/span><\/li><\/ul><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-5c08d127 ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default elementor-invisible\" data-id=\"5c08d127\" data-element_type=\"section\" data-settings=\"{&quot;animation&quot;:&quot;bounceInRight&quot;,&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-2aeef5b1 ot-flex-column-vertical\" data-id=\"2aeef5b1\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-30cca56f elementor-widget elementor-widget-heading\" data-id=\"30cca56f\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Try our Active Directory & Office 365 Reporting & Auditing Tools<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-58d8b704 elementor-widget elementor-widget-text-editor\" data-id=\"58d8b704\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #ff6600;\">Try us out<\/span> for <span style=\"color: #ff0000;\">Free<\/span>.\u00a0 100&#8217;s of report templates available. Easily customise your own reports on AD, Azure AD &amp; Office 355.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-2151732d ot-flex-column-vertical\" data-id=\"2151732d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4b161ca2 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"4b161ca2\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor-pro - v3.10.3 - 29-01-2023 *\/\n.elementor-button.elementor-hidden,.elementor-hidden{display:none}.e-form__step{width:100%}.e-form__step:not(.elementor-hidden){display:flex;flex-wrap:wrap}.e-form__buttons{flex-wrap:wrap}.e-form__buttons,.e-form__buttons__wrapper{display:flex}.e-form__indicators{display:flex;justify-content:space-between;align-items:center;flex-wrap:nowrap;font-size:13px;margin-bottom:var(--e-form-steps-indicators-spacing)}.e-form__indicators__indicator{display:flex;flex-direction:column;align-items:center;justify-content:center;flex-basis:0;padding:0 var(--e-form-steps-divider-gap)}.e-form__indicators__indicator__progress{width:100%;position:relative;background-color:var(--e-form-steps-indicator-progress-background-color);border-radius:var(--e-form-steps-indicator-progress-border-radius);overflow:hidden}.e-form__indicators__indicator__progress__meter{width:var(--e-form-steps-indicator-progress-meter-width,0);height:var(--e-form-steps-indicator-progress-height);line-height:var(--e-form-steps-indicator-progress-height);padding-right:15px;border-radius:var(--e-form-steps-indicator-progress-border-radius);background-color:var(--e-form-steps-indicator-progress-color);color:var(--e-form-steps-indicator-progress-meter-color);text-align:right;transition:width .1s linear}.e-form__indicators__indicator:first-child{padding-left:0}.e-form__indicators__indicator:last-child{padding-right:0}.e-form__indicators__indicator--state-inactive{color:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-inactive [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-inactive-secondary-color,#fff)}.e-form__indicators__indicator--state-inactive object,.e-form__indicators__indicator--state-inactive svg{fill:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-active{color:var(--e-form-steps-indicator-active-primary-color,#39b54a);border-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active object,.e-form__indicators__indicator--state-active svg{fill:var(--e-form-steps-indicator-active-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed{color:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator--state-completed [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator__label{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator--shape-none{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a);background-color:initial}.e-form__indicators__indicator--state-completed object,.e-form__indicators__indicator--state-completed svg{fill:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator__icon{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);font-size:var(--e-form-steps-indicator-icon-size);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;overflow:hidden;margin-bottom:10px}.e-form__indicators__indicator__icon img,.e-form__indicators__indicator__icon object,.e-form__indicators__indicator__icon svg{width:var(--e-form-steps-indicator-icon-size);height:auto}.e-form__indicators__indicator__icon .e-font-icon-svg{height:1em}.e-form__indicators__indicator__number{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;margin-bottom:10px}.e-form__indicators__indicator--shape-circle{border-radius:50%}.e-form__indicators__indicator--shape-square{border-radius:0}.e-form__indicators__indicator--shape-rounded{border-radius:5px}.e-form__indicators__indicator--shape-none{border:0}.e-form__indicators__indicator__label{text-align:center}.e-form__indicators__indicator__separator{width:100%;height:var(--e-form-steps-divider-width);background-color:#c2cbd2}.e-form__indicators--type-icon,.e-form__indicators--type-icon_text,.e-form__indicators--type-number,.e-form__indicators--type-number_text{align-items:flex-start}.e-form__indicators--type-icon .e-form__indicators__indicator__separator,.e-form__indicators--type-icon_text .e-form__indicators__indicator__separator,.e-form__indicators--type-number .e-form__indicators__indicator__separator,.e-form__indicators--type-number_text .e-form__indicators__indicator__separator{margin-top:calc(var(--e-form-steps-indicator-padding, 30px) \/ 2 - var(--e-form-steps-divider-width, 1px) \/ 2)}.elementor-field-type-hidden{display:none}.elementor-field-type-html{display:inline-block}.elementor-login .elementor-lost-password,.elementor-login .elementor-remember-me{font-size:.85em}.elementor-field-type-recaptcha_v3 .elementor-field-label{display:none}.elementor-field-type-recaptcha_v3 .grecaptcha-badge{z-index:1}.elementor-button .elementor-form-spinner{order:3}.elementor-form .elementor-button>span{display:flex;justify-content:center;align-items:center}.elementor-form .elementor-button .elementor-button-text{white-space:normal;flex-grow:0}.elementor-form .elementor-button svg{height:auto}.elementor-form .elementor-button .e-font-icon-svg{height:1em}.elementor-select-wrapper .select-caret-down-wrapper{position:absolute;top:50%;transform:translateY(-50%);inset-inline-end:10px;pointer-events:none;font-size:11px}.elementor-select-wrapper .select-caret-down-wrapper svg{display:unset;width:1em;aspect-ratio:unset;fill:currentColor}.elementor-select-wrapper .select-caret-down-wrapper i{font-size:19px;line-height:2}.elementor-select-wrapper.remove-before:before{content:\"\"!important}<\/style>\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"54428\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"4b161ca2\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-2a0276f e-con-boxed e-con\" data-id=\"2a0276f\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6c67de3 elementor-widget elementor-widget-text-editor\" data-id=\"6c67de3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/active-directory-reporting\/gpo-reports\/\">Try InfraSOS Active Directory GPO Reports Tool<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad1033d elementor-widget elementor-widget-heading\" data-id=\"ad1033d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Viewing Events Using Windows Event Viewer<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-79d7916 e-con-boxed e-con\" data-id=\"79d7916\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-892fdf2 elementor-widget elementor-widget-text-editor\" data-id=\"892fdf2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span data-preserver-spaces=\"true\">After <a href=\"https:\/\/learn.microsoft.com\/en-us\/purview\/audit-log-enable-disable\" target=\"_blank\" rel=\"noopener\">enabling auditing<\/a>, we\u00a0 use Event Viewer to see the logs and investigate events by following the below-mentioned steps:<\/span><\/p><ul><li><span data-preserver-spaces=\"true\">Click on\u00a0<\/span><strong><span data-preserver-spaces=\"true\">Start \u2794 Administrative Tools \u2794 Event Viewer<\/span><\/strong><\/li><li><span data-preserver-spaces=\"true\">Click\u00a0<\/span><strong><span data-preserver-spaces=\"true\">Windows Logs<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0and select\u00a0<\/span><strong><span data-preserver-spaces=\"true\">Security<\/span><\/strong><span data-preserver-spaces=\"true\">. We see all the events logged in security logs.<\/span><\/li><li><span data-preserver-spaces=\"true\">Search the desired Event ID using the\u00a0<\/span><strong><span data-preserver-spaces=\"true\">Find<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0option or\u00a0<\/span><strong><span data-preserver-spaces=\"true\">create a custom view<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0to find the event logs we seek.<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-f10bc3f e-con-boxed e-con\" data-id=\"f10bc3f\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1ecaf4d elementor-widget elementor-widget-image\" data-id=\"1ecaf4d\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/windows-security-events-1.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"windows security events\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ0MzEsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA5XC93aW5kb3dzLXNlY3VyaXR5LWV2ZW50cy0xLnBuZyJ9\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"359\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/windows-security-events-1-768x359.png\" class=\"attachment-medium_large size-medium_large wp-image-54431\" alt=\"windows security events\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/windows-security-events-1-768x359.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/windows-security-events-1-300x140.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/windows-security-events-1-1024x479.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/windows-security-events-1-1536x718.png 1536w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/windows-security-events-1-720x337.png 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/windows-security-events-1.png 1920w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-8f34b87 e-con-boxed e-con\" data-id=\"8f34b87\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-82706a5 elementor-widget elementor-widget-text-editor\" data-id=\"82706a5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Windows, being the predominant platform in most enterprise networks, the security logs generated by these are voluminous. Doing each recorded security event manually to identify anomalous activities is practically impossible.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-84a4d01 e-con-boxed e-con\" data-id=\"84a4d01\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7a1de7e elementor-widget elementor-widget-text-editor\" data-id=\"7a1de7e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/active-directory-reporting\/user-reports\/logon-logoff-report\/\">Try InfraSOS Active Directory User Logon Auditing Tool <\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e384fc3 elementor-widget elementor-widget-heading\" data-id=\"e384fc3\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Windows Security Event Log Best Practices<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1a14471 e-con-boxed e-con\" data-id=\"1a14471\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-caf50e1 elementor-widget elementor-widget-text-editor\" data-id=\"caf50e1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Without planning, our Windows audit policies generate high volumes of overwhelming data. We should follow some basic strategies to use Windows security event logs for Security and compliance effectively. At the highest level, we must understand the logical grouping of resources and activities that require auditing.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-7a74be1 e-con-boxed e-con\" data-id=\"7a74be1\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f2da516 elementor-widget elementor-widget-heading\" data-id=\"f2da516\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Windows Log Management <\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7cf5285 elementor-widget elementor-widget-text-editor\" data-id=\"7cf5285\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ol><li><strong><span data-preserver-spaces=\"true\">Enable Relevant Audit Policies:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Ensure key audit policies, including account logon\/logoff, privilege use, object access, policy change, and system events, are activated based on organizational security needs.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Regular Log Review and Clearance:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Conduct periodic reviews and clear event logs to prevent capacity issues. Implement automated log rotation and archival processes for efficient log management.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Centralized Logging:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Utilize tools like Windows Event Forwarding or third-party solutions to centralize logs, providing a unified view for analysis and alerting.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Event Log Retention Policy:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Establish a clear event log retention policy following regulatory requirements and organizational security standards.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Real-time Monitoring and Alerts:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Implement real-time monitoring for critical security events and configure alerts for specific event IDs or patterns to facilitate proactive threat detection.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Secure Access Control:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Restrict access to event logs to authorized personnel, following the principle of <a href=\"https:\/\/infrasos.com\/top-10-best-iam-tools-identity-access-management\/\">least privilege to prevent unauthorized tampering<\/a>.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Event Log Backups:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Regularly back up security event logs to preserve data in case of system failures or security incidents. Backups are essential for forensic analysis.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Keep System Updated:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Microsoft regularly updates the Windows operating system and<a href=\"https:\/\/infrasos.com\/windows-patch-management-how-to-keep-windows-server-secure-up-to-date\/\"> security software with the latest patches to address known vulnerabilities<\/a>.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\">Personnel Training:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0Provide training to IT personnel responsible for monitoring and managing security event logs. Equip them with knowledge about everyday security events and appropriate response measures.<\/span><\/li><li><strong><span data-preserver-spaces=\"true\"><a href=\"https:\/\/infrasos.com\/soar-vs-siem-whats-the-difference\/\">Integration with SIEM Solutions<\/a>:<\/span><\/strong><span data-preserver-spaces=\"true\">\u00a0If relevant, incorporate event registers into Security Information and Event Management (SIEM) solutions to enhance analysis, correlation, and reporting capabilities.<\/span><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fbcafb5 elementor-widget elementor-widget-image\" data-id=\"fbcafb5\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-viewer-audit.jpg\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"event viewer audit\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTQ0MzIsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzA5XC9ldmVudC12aWV3ZXItYXVkaXQuanBnIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"647\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-viewer-audit-768x647.jpg\" class=\"attachment-medium_large size-medium_large wp-image-54432\" alt=\"event viewer audit\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-viewer-audit-768x647.jpg 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-viewer-audit-300x253.jpg 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-viewer-audit-720x607.jpg 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/09\/event-viewer-audit.jpg 859w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-244a869 e-con-boxed e-con\" data-id=\"244a869\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e59eb79 elementor-widget elementor-widget-text-editor\" data-id=\"e59eb79\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Thank you for your time. We conclude the article How to Monitor and Audit Your Windows Server for Security Events..\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dd782a5 elementor-widget elementor-widget-text-editor\" data-id=\"dd782a5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/how-to-protect-windows-server-malware-ransomware-ddos-attacks-other-threats\/\">How to Protect Windows Server: Malware, Ransomware, DDoS Attacks &amp; Other Threats\u00a0<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9e388ea elementor-widget elementor-widget-heading\" data-id=\"9e388ea\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">How to Monitor and Audit Your Windows Server for Security Events Conclusion<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-75ae7d4 e-con-boxed e-con\" data-id=\"75ae7d4\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a06cff2 elementor-widget elementor-widget-text-editor\" data-id=\"a06cff2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In conclusion, the meticulous orchestration of Windows Server monitoring and auditing is not just a best practice; it&#8217;s a strategic imperative in cybersecurity. By implementing robust monitoring tools and proactive auditing practices, organizations create a resilient defence against potential security threats, ensuring the continuous integrity of their server environment. As the digital landscape evolves, the commitment to vigilance through monitoring and auditing becomes a safeguard and a cornerstone in fortifying the foundations of a secure and reliable Windows Server infrastructure.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-54009915 elementor-section-content-middle ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"54009915\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-extended\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-5603b8ab ot-flex-column-vertical\" data-id=\"5603b8ab\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-30b20621 elementor-widget elementor-widget-image\" data-id=\"30b20621\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"113\" height=\"101\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/05\/InfraSOS-Logo-Icon-1.png\" class=\"attachment-full size-full wp-image-5788\" alt=\"InfraSOS-AD-Tools\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-2bb06da4 ot-flex-column-vertical\" data-id=\"2bb06da4\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6e932f37 elementor-widget elementor-widget-heading\" data-id=\"6e932f37\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Try InfraSOS for FREE<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5cdbe44d elementor-widget elementor-widget-text-editor\" data-id=\"5cdbe44d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Try InfraSOS Active Directory, Azure AD &amp; Office 365 Reporting &amp; Auditing Tool<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-75f200b9 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"75f200b9\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"54428\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"75f200b9\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7d15aca4 elementor-icon-list--layout-inline elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"7d15aca4\" data-element_type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/infrasos.com\/wp-content\/plugins\/elementor\/assets\/css\/widget-icon-list.min.css\">\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-up\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Free 15-Days Trial<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">SaaS AD Reporting & Auditing Solution<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>How to Monitor and Audit Your Windows Server for Security Events. In the dynamic landscape of IT infrastructure, safeguarding the integrity and Security of our Windows Server environment is paramount. Effective monitoring and auditing are not just proactive measures. They are the vigilant guardians that ensure the resilience of our system against potential threats and [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37,111],"tags":[113,68],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Monitor and Audit Your Windows Server for Security Events<\/title>\n<meta name=\"description\" content=\"How to Monitor and Audit Your Windows Server for Security Events. In the dynamic landscape of IT infrastructure, safeguarding the integrity and Security\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Monitor and Audit Your Windows Server for Security Events\" \/>\n<meta property=\"og:description\" content=\"How to Monitor and Audit Your Windows Server for Security Events. In the dynamic landscape of IT infrastructure, safeguarding the integrity and Security\" \/>\n<meta property=\"og:url\" content=\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/\" \/>\n<meta property=\"og:site_name\" content=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infrasos\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-02T09:20:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-02T09:20:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Untitled-2-3-qd9bof93l04u89lkcwiyw4hlta3zmhmubx88ekvb1c.png\" \/>\n<meta name=\"author\" content=\"Marion Mendoza\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:site\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Marion Mendoza\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/\"},\"author\":{\"name\":\"Marion Mendoza\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/ad83c2c1c7a69db768dcf68c16a09dc1\"},\"headline\":\"How to Monitor and Audit Your Windows Server for Security Events\",\"datePublished\":\"2023-10-02T09:20:01+00:00\",\"dateModified\":\"2023-10-02T09:20:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/\"},\"wordCount\":1390,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"keywords\":[\"monitoring\",\"windows server\"],\"articleSection\":[\"Monitoring\",\"Windows\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/\",\"url\":\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/\",\"name\":\"How to Monitor and Audit Your Windows Server for Security Events\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/#website\"},\"datePublished\":\"2023-10-02T09:20:01+00:00\",\"dateModified\":\"2023-10-02T09:20:03+00:00\",\"description\":\"How to Monitor and Audit Your Windows Server for Security Events. In the dynamic landscape of IT infrastructure, safeguarding the integrity and Security\",\"breadcrumb\":{\"@id\":\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/infrasos.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Monitor and Audit Your Windows Server for Security Events\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/infrasos.com\/#website\",\"url\":\"https:\/\/infrasos.com\/\",\"name\":\"Active Directory Tools, Report, Monitor &amp; Manage AD\",\"description\":\"Active Directory &amp; Office 365 SaaS Reporting Tool\",\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/infrasos.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/infrasos.com\/#organization\",\"name\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\",\"url\":\"https:\/\/infrasos.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"contentUrl\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"width\":113,\"height\":101,\"caption\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\"},\"image\":{\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/infrasos\/\",\"https:\/\/twitter.com\/infra_sos\",\"https:\/\/www.linkedin.com\/showcase\/86283876\",\"https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/ad83c2c1c7a69db768dcf68c16a09dc1\",\"name\":\"Marion Mendoza\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/30fe5e9718f2d84e943c56822bf2c846?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/30fe5e9718f2d84e943c56822bf2c846?s=96&d=mm&r=g\",\"caption\":\"Marion Mendoza\"},\"description\":\"Windows Server and VMware SME. Powershell Guru. Currently working with Fortune 500 companies responsible for participating in 3rd level systems support across the enterprise. Acting as a Windows Server engineer and VMware Specialist.\",\"url\":\"https:\/\/infrasos.com\/author\/marionpkm\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Monitor and Audit Your Windows Server for Security Events","description":"How to Monitor and Audit Your Windows Server for Security Events. In the dynamic landscape of IT infrastructure, safeguarding the integrity and Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/","og_locale":"en_US","og_type":"article","og_title":"How to Monitor and Audit Your Windows Server for Security Events","og_description":"How to Monitor and Audit Your Windows Server for Security Events. In the dynamic landscape of IT infrastructure, safeguarding the integrity and Security","og_url":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/","og_site_name":"Active Directory Tools, Report, Monitor &amp; Manage AD","article_publisher":"https:\/\/www.facebook.com\/infrasos\/","article_published_time":"2023-10-02T09:20:01+00:00","article_modified_time":"2023-10-02T09:20:03+00:00","og_image":[{"url":"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/Untitled-2-3-qd9bof93l04u89lkcwiyw4hlta3zmhmubx88ekvb1c.png"}],"author":"Marion Mendoza","twitter_card":"summary_large_image","twitter_creator":"@infra_sos","twitter_site":"@infra_sos","twitter_misc":{"Written by":"Marion Mendoza","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/#article","isPartOf":{"@id":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/"},"author":{"name":"Marion Mendoza","@id":"https:\/\/infrasos.com\/#\/schema\/person\/ad83c2c1c7a69db768dcf68c16a09dc1"},"headline":"How to Monitor and Audit Your Windows Server for Security Events","datePublished":"2023-10-02T09:20:01+00:00","dateModified":"2023-10-02T09:20:03+00:00","mainEntityOfPage":{"@id":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/"},"wordCount":1390,"commentCount":0,"publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"keywords":["monitoring","windows server"],"articleSection":["Monitoring","Windows"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/","url":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/","name":"How to Monitor and Audit Your Windows Server for Security Events","isPartOf":{"@id":"https:\/\/infrasos.com\/#website"},"datePublished":"2023-10-02T09:20:01+00:00","dateModified":"2023-10-02T09:20:03+00:00","description":"How to Monitor and Audit Your Windows Server for Security Events. In the dynamic landscape of IT infrastructure, safeguarding the integrity and Security","breadcrumb":{"@id":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/infrasos.com\/how-to-monitor-and-audit-your-windows-server-for-security-events\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/infrasos.com\/"},{"@type":"ListItem","position":2,"name":"How to Monitor and Audit Your Windows Server for Security Events"}]},{"@type":"WebSite","@id":"https:\/\/infrasos.com\/#website","url":"https:\/\/infrasos.com\/","name":"Active Directory Tools, Report, Monitor &amp; Manage AD","description":"Active Directory &amp; Office 365 SaaS Reporting Tool","publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/infrasos.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/infrasos.com\/#organization","name":"InfraSOS - Active Directory & Office 365 Reporting Tools","url":"https:\/\/infrasos.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/","url":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","contentUrl":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","width":113,"height":101,"caption":"InfraSOS - Active Directory & Office 365 Reporting Tools"},"image":{"@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infrasos\/","https:\/\/twitter.com\/infra_sos","https:\/\/www.linkedin.com\/showcase\/86283876","https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg"]},{"@type":"Person","@id":"https:\/\/infrasos.com\/#\/schema\/person\/ad83c2c1c7a69db768dcf68c16a09dc1","name":"Marion Mendoza","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/30fe5e9718f2d84e943c56822bf2c846?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/30fe5e9718f2d84e943c56822bf2c846?s=96&d=mm&r=g","caption":"Marion Mendoza"},"description":"Windows Server and VMware SME. Powershell Guru. Currently working with Fortune 500 companies responsible for participating in 3rd level systems support across the enterprise. Acting as a Windows Server engineer and VMware Specialist.","url":"https:\/\/infrasos.com\/author\/marionpkm\/"}]}},"_links":{"self":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/54428"}],"collection":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/comments?post=54428"}],"version-history":[{"count":29,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/54428\/revisions"}],"predecessor-version":[{"id":54461,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/54428\/revisions\/54461"}],"wp:attachment":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/media?parent=54428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/categories?post=54428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/tags?post=54428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}