With native auditing, here is how you can track activities of privileged users:

• Step 1: Identify the privileged user accounts.

• • If a member satisfies any of the below mentioned criteria, they can be identified as privileged users.
    1. Users/Groups who are members of any administrative groups.
    2. Users/Groups who have received administrative privileges through their Organizational Unit.
    3. Local user accounts and service accounts that may have received administrative privileges locally on domain controllers.
    4. Users who have received privileges to reset passwords and unlock the accounts of other users.
    5. Users having administrative privileges by which they can access Service Accounts.
    6. Users who have write access to Group Policy Objects related to domain controllers.
    7. Users who have access to any application that manages Active Directory. Users who are administrator of the Virtual System Environment.

You can list all privileged users by using Active Directory Users and Computers and Group Policy Management Console.

To discover other privileged user accounts you may also have to run customized scripts. For instance, every member of any administrative group is a privileged user.

• Step 2: Enabling the required audit policies

• Launch Server Manager in your Windows Server instance.

• Under Manage, select Group Policy Management and launch the Group Policy Management console.

• Navigate to Forest → Domain → Your domain → Domain Controllers.

• Create a new GPO and link it to the domain containing the user object, or edit any existing GPO that is linked to the domain to open the Group Policy Management Editor.

• Navigate to omputer Configuration → Windows Settings → Security Settings → Local Policies → Audit Policy.

• The Audit Policy lists all of its sub-policies in the right panel, as shown in Figure 1.

• Select the policies you want to enable for both its successful and failure events. In the event of multiple failures, the organisation can initiate security protocol, if necessary.

• Click Apply and OK to close Properties window.

• 

• Step 3: Configuring the advanced audit policy

• Launch Server Manager in your Windows Server instance.

• Under Manage, select Group Policy Management and launch the Group Policy Management console.

• Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Select Audit Policies.

• Force audit policy subcategory settings to override audit policy category settings in Group Policy to make sure that basic auditing is disabled.

• 

Decide on the policies you want to enable and select both Success and Failure options.

• Step 4: View events using Windows Event Viewer

• • After enabling the auditing, you can use Event Viewer to see the logs and investigate events. Follow the below mentioned steps:
    1. Click on Start → Administrative Tools → Event Viewer
    2. Click Windows Logs and select Security. You will see all the events logged in security logs.
    3. Make a search using Find option to see events for a specific privileged account or create a custom view to show the events generated by a particular user only.
•