Active Directory Security Monitoring: The Events That Actually Matter

What Is Active Directory Security Monitoring?

Active Directory is the most targeted infrastructure component in enterprise environments — yet it is also one of the least monitored. Most organizations generate Windows Security events from Domain Controllers but lack the correlation, alerting, and baseline analysis needed to detect attacks in progress.

Security monitoring in AD is not about collecting logs — it is about knowing which events matter, what normal looks like, and when something deviates. Without this, every attack described in this blog — Kerberoasting, Golden Tickets, DCSync, ADCS abuse — proceeds undetected until the damage is done.

This article covers the essential audit policy configuration, the critical event IDs to monitor, and how to build detection logic that catches real attacks without alert fatigue.

How It Works

Windows Security auditing is controlled by Advanced Audit Policy settings deployed via Group Policy. By default, most audit categories are not enabled or are configured at a minimum level that misses critical events.

The audit pipeline:

1. Advanced Audit Policy enables event generation for specific activity categories
2. Windows Event Log stores events locally (Security log)
3. WEF (Windows Event Forwarding) or a SIEM agent ships events to a central collection point
4. SIEM correlation rules detect patterns and fire alerts

The most common failure is step 1: audit policy is not configured, so critical events like object access, privilege use, and directory service changes never fire — even if everything else is in place.

The Attack Chain (What Goes Undetected Without Monitoring)

Without proper monitoring, attackers operate freely:

DCSync — No Audit Policy

Without Audit Directory Service Access enabled, event 4662 never fires. A full DCSync dumping all domain hashes leaves no trace in the Security log.

Golden Ticket — No Anomaly Detection

Event 4768 fires for every TGT request — but without baselining normal Kerberos traffic, a forged ticket with a 10-year lifetime and a non-existent username blends in with thousands of legitimate requests.

Lateral Movement — No Logon Tracking

Without Audit Logon Events and network logon correlation, Pass-the-Hash and Pass-the-Ticket movement across the domain is invisible.

Privilege Escalation — No Group Change Alerts

Without alerting on 4728/4732/4756, adding a backdoor account to Domain Admins generates no notification.

Detection

Essential Audit Policy Configuration

Deploy via GPO: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration

Critical Event IDs Reference

SIEM Detection Queries (Elastic KQL)

DCSync detection:

event.code: "4662" AND
winlog.event_data.Properties: ("*1131f6ad*" OR "*1131f6aa*") AND
NOT winlog.event_data.SubjectUserName: ("*$")

Kerberoasting detection:

event.code: "4769" AND
winlog.event_data.TicketEncryptionType: "0x17" AND
NOT winlog.event_data.ServiceName: ("krbtgt" OR "*$")

Golden Ticket anomaly:

event.code: "4768" AND
winlog.event_data.TicketOptions: "0x40810010" AND
winlog.event_data.PreAuthType: "0"

Privileged group change:

event.code: ("4728" OR "4732" OR "4756") AND
winlog.event_data.TargetUserName: ("Domain Admins" OR "Enterprise Admins" OR "Schema Admins")

💡 Tip: Start with 5-10 high-confidence, low-noise detections rather than enabling every possible alert. DCSync, privileged group changes, and Kerberoasting detections have near-zero false positive rates when tuned correctly.

Remediation

💡 Quick Win: Enable Audit Directory Service Changes and Audit Directory Service Access on all Domain Controllers immediately. These two subcategories catch the majority of critical AD attacks.

1. Deploy Advanced Audit Policy via GPO

# Verify current audit policy on a DC
auditpol /get /category:*

# Set critical subcategories
auditpol /set /subcategory:"Directory Service Changes" /success:enable
auditpol /set /subcategory:"Directory Service Access" /success:enable
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
auditpol /set /subcategory:"Security Group Management" /success:enable
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable

2. Increase Security Log Size

The default Security log size (20MB) fills in hours on a busy DC. Increase to at least 1GB:

# Set Security log to 1GB with archive-when-full retention
wevtutil sl Security /ms:1073741824 /rt:false /ab:true

Or via GPO: Computer Configuration > Windows Settings > Security Settings > Event Log > Maximum security log size = 1048576 KB

3. Implement Windows Event Forwarding

Forward DC Security events to a central Windows Event Collector:

# On collector: enable WinRM and configure subscription
winrm quickconfig
wecutil cs subscription.xml

# On source DCs: configure to forward to collector
gpupdate /force

4. Establish Kerberos and Logon Baselines

# Count TGT requests per hour baseline (run over 1 week)
Get-WinEvent -ComputerName DC01 -FilterHashtable @{LogName='Security'; Id=4768} |
    Group-Object {$_.TimeCreated.Hour} |
    Select-Object Name, Count |
    Sort-Object Name

Use the baseline to tune anomaly detection thresholds in your SIEM.

How EtcSec Detects This

EtcSec checks your audit policy configuration as part of every AD scan, identifying gaps that would leave critical attacks undetected.

Monitoring-related checks flag Domain Controllers with insufficient audit policy coverage, missing log forwarding configuration, and Security log sizes too small to retain meaningful history.

These findings appear in the Monitoring category of every EtcSec report, with specific recommendations for the subcategories and event IDs needed to detect each vulnerability class that EtcSec identifies in your environment.

ℹ️ Note: EtcSec audits your security monitoring posture alongside your AD configuration. Run a free audit to see what attacks your current logging would miss.

Related articles: Golden Ticket Attack | ACL Abuse and DCSync | ADCS Certificate Attacks