Every Windows Server in the world is quietly writing a diary of who signed in, who failed, and who changed what. Almost nobody reads it. This page is about closing that gap.
Audit Policy is the easiest item in the top ten to switch on and the easiest to waste. One GPO later, your domain controllers record every successful and failed sign-in - gigabytes of truthful, timestamped evidence. And then, in most offices, nothing happens, because the log is only ever opened after an incident, when everyone discovers it was overwritten weeks ago or that nobody knows what a normal week looks like. Auditing is not a setting. It is a habit with a setting attached. This page covers both halves honestly.
Four event IDs carry most of the value in a small office. Learn these before enabling anything exotic.
Use Advanced Audit Policy Configuration (it overrides the old basic categories cleanly) and start narrow: Logon/Logoff - success and failure, Account Management - success, and Policy Change - success. That is enough to answer the questions offices actually ask: who signed in, who kept failing, who created that account, who changed the rules.
The beginner's instinct is to audit everything, including every file open. Resist it. Object-access auditing fills the log with millions of events, pushes out the logon history you actually need within days, and slows busy servers. You can add one targeted file-audit on the salary folder later - with a SACL on that folder, which object auditing also requires - when there is a specific question to answer.
The Security log wraps around: when it fills, the oldest events vanish. On a default-sized log, a busy domain controller can overwrite its own memory in days - meaning the incident you investigate next month has already evaporated.
Raise the maximum Security log size on domain controllers (a few hundred MB is a common office choice) through the same GPO family, and decide the retention question honestly: archive when full, or overwrite as needed with a size big enough to hold your real history. An audit policy without a retention decision is a diary with the first pages torn out continuously.
Here is the entire management system: fifteen minutes, once a week, same time. Open the domain controller's Security log, filter for 4625 failures, and look at three things - failures against accounts that should not be failing (the director, service accounts), failures from one workstation hammering many accounts, and any successful logon at an hour the office is closed.
You are not hunting hackers; you are building a picture of normal. Normal is what makes abnormal visible. The admin who has scrolled the failures weekly for two months spots the odd pattern in seconds - the admin opening the log for the first time during a crisis sees only noise.
A failing service account after a password change, retrying thousands of times - the log tells you before the lockout policy fills your morning. A user account signing in from the office PC and, simultaneously, from a workstation nobody recognises - the log asks the question while there is still time. An account created on a Saturday night by an admin who was on leave - the log does not accuse anyone, it simply refuses to forget.
None of these need a SIEM or an expensive dashboard. They need 4624, 4625 and the account-management events, a log big enough to hold them, and a human with a calendar reminder. Forwarding events to a central collector (Windows Event Forwarding is built in) is the graduation step when the habit outgrows one server's log.
Close with the honesty this policy deserves. Auditing prevents nothing. It does not stop the sign-in, block the copy, or save the file. It testifies afterwards - brilliantly, if the log survived and someone reads it; not at all, otherwise.
That is why it sits at number nine in the top ten rather than number one: it is the witness, not the lock. Password policy, screen lock and local admin control prevent; audit policy proves. An office needs both, and the admin who confuses recording with protection has bought a camera for a door with no latch.
The audit categories and log settings are switched on live in the Top 10 GPO video - then come back here for the reading habit that makes them worth it.
▶️ Watch Full VideoAdvanced Audit Policy Configuration. It gives granular subcategories (logon separate from account management, for example) and, when the setting to force advanced categories is enabled, it cleanly overrides the legacy basic policy instead of mixing with it. The old categories survive mainly in old documentation.
Long enough to investigate the incident you are likely to have. Most offices discover problems within days or weeks, so a log sized to hold at least 30 to 90 days of logon history on domain controllers is a sane target. Regulated offices archive logs off the server; the key decision is that someone made one at all.
Logon and account-management auditing at office scale is effectively free. What costs performance and disk is mass object-access auditing - recording every file touch on a busy file server. That is exactly why this guide starts narrow: the valuable events are also the cheap ones.