Active Directory Audit

Alerts

• Active Directory-Audit Kerberos authentication: This alert is generated when a Kerberos authentication ticket is requested or failed.
• Active Directory-Audit DPAPI activity: This alert is generated when backup or recovery of data protection master key is attempted.

Reports

• Active Directory-Audit Kerberos authentication: This report provides details about all the Kerberos authentication services.
• Active Directory-Audit Kerberos service ticket operations: This report provides details about all the Kerberos service ticket operations, whether it was requested or renewed.
• Active Directory-Audit DPAPI activity: This report provides all Audit DPAPI protocol activity.

Alerts

• Active Directory-Audit detailed directory service replication: This alert is generated when an Active Directory replica source naming context was established, removed, modified or failed.

Reports

• Active Directory-Audit RPC events: This report provides details about all the RPC events that was attempted.
• Active Directory-Audit process termination: This report provides all the terminated or exited process details.
• Active Directory-Audit directory service replication: This report provides all the directory service replication details.
• Active Directory-Audit detailed directory service replication: This report provides the details about an Active Directory replica source naming context if it is established, removed, modified or failed.
• Active Directory-Audit directory service changes: This report provides all the directory configuration changes such as a directory being created, deleted, modified, moved or undeleted.

Alerts

• Active Directory-Account management activities: This alert is generated when any account is created, deleted, changed, enabled or disabled in Windows Active Directory.
• Active Directory-Account logon events: This alert is generated when any successful logon, successful log off, special privileges logon or Logon failures done in Windows Active Directory.

Reports

• Active Directory-Account management activities: This report provides all the details about an account if it is created, deleted, changed, enabled or disabled in Windows Active Directory.
• Active Directory-Account logon events: This report provides details about all the successful logon, successful log off, special privileges logon and Logon failures done in Windows Active Directory.
• Active Directory-Audit other account logon events: This report provides details about all the account logon events.