- Free Edition
- Quick Links
- Active Directory Auditing
- Active Directory auditor
- Active Directory monitoring
- Account lockout analyzer
- Login monitoring software
- Active Directory change notifier
- User logon audit reports
- AD logon logoff tracker
- User logon failure auditing
- Login history tracking tool
- AD change auditor
- Insider threat detection software
- Permissions change auditing
- Entra ID reporting
- Privileged user monitoring
- User behavior analytics tool
- Active Directory security monitoring
- Group Policy auditing tool
- GPO change auditor
- Entra ID auditing
- Audit user account management
- OU change auditor
- Audit group membership changes
- Active Directory auditing and reporting tool
- GPO reporting tool
- Remote desktop monitoring software
- PowerShell logging and auditing
- Azure password protection auditing
- Azure sign-in risk detection
- File Server Auditing
- Windows Server Auditing
- Employee Tracking
- Workstations Auditing
- Compliance Auditing
- Other features
- SIEM Integration
- Windows DNS - Schema Auditing
- Windows security event log monitoring
- SIEM audit solution
- Schedule Active Directory change reports
- Reports from Archived Data
- Aggregated summary reports
- AD new/old attribute changes
- Audit trail
- Audit Active Directory LAPS
- Scheduled Reports & Alerts
- Account lockout examiner
- Industry
- Documents
- Success Stories
- Related Products
- Log360 (On-Premise | Cloud) Comprehensive SIEM and UEBA
- ADManager Plus Active Directory Management & Reporting
- EventLog Analyzer Real-time Log Analysis & Reporting
- ADSelfService Plus Identity security with MFA, SSO, and SSPR
- DataSecurity Plus File server auditing & data discovery
- Exchange Reporter Plus Exchange Server Auditing & Reporting
- M365 Manager Plus Microsoft 365 Management & Reporting Tool
- RecoveryManager Plus Enterprise backup and recovery tool
- SharePoint Manager Plus SharePoint Reporting and Auditing
- AD360 Integrated Identity & Access Management
- AD Free Tools Active Directory FREE Tools
How to configure advanced audit policies.
Written by Mahidhar Adarsh, IT security team, ManageEngine Updated on July 2026
Contents
- Significance of advanced audit policies
- Groundworkforconfiguringanadvanced audit policy
- Steps to configure any advanced audit policy setting
- Theten advanced audit policy categories in brief
- Fivekey points tokeep in mind
Significance of advanced audit policies.
The purpose of security auditing is to ensure that events are logged whenever an activity occurs. However, when every activity is audited, event logs become flooded with irrelevant information that makes it difficult for network administrators to separate critical events from insignificant ones. Advanced audit policy settings help administrators exercise granular control over which activities get recorded in the logs, helping cut down on event noise. As an example, instead of turning on the DS Access audit policy category to troubleshoot a replication problem—which would generate around eight events every time this activity occurs—an administrator could turn on the advanced audit policy subcategory for Directory Service Replication, which would only generate one event instead of eight.
Groundwork for configuring an advanced audit policy.
- Identify the most important activities in your network that need to be tracked. Check out the 8 most critical event IDs as a starting point.
- Identify the security audit settings that can be used to track these activities.
- Assess the potential advantages and disadvantages (implications on event log size, for example) of each of these setting.
- Configure and manage security audit settings (in addition to audit policies and advanced audit policies, you must also configure System Access Control Lists (SACLs) to enable auditing on directory objects and files/folders).
Forinformation onhow to configureSACLs, visit our help document.
Steps to configure any advanced audit policy setting.
Setting an advanced audit policy requires administrator-level account permissions or the appropriate delegated permissions.
- From the Domain Controller, click Start, point to Administrative Tools, and then Group Policy Management.
- From the console tree, click the name of your forest Domains your domain, then right-click on the relevant Default Domain or Domain Controllers Policy (or create your own policy), and then click Edit.
- Under Computer Configuration, click Policies Windows Settings Security Settings Advanced Audit Policy Configuration Audit Policy, then double-click on the relevant policy setting.
- In the right pane, right-click on the relevant Subcategory, and then click Properties.
- Select Success, Failure, or both from the audit events checkbox and then click OK.
Choosing to log successes, failures, or both.
You should assess the advantages and disadvantages before choosing to log successes, failures, or both. For example, for files that are frequently accessed by legitimate users, successful access attempts will quickly fill the event log with benign events. Since failed login events can indicate unauthorized access attempts, those are the events that should be audited in this scenario. On the other hand, for files with sensitive information, every access attempt should be logged (both successful and failed), so that you have an audit trail of every user who accessed the file.
Five key points to keep in mind.
- Audit policies are computer policies. This means an advanced audit policy must be applied through GPOs that are applied to OUs containing computers and not user OUs.
- The Default Domain Policy is linked to the domain and affects all users and computers in that domain through group policy inheritance. While the Default Domain Controllers Policy is linked to the Domain Controllers OU and affects only domain controllers. Policy settings that are applied at the OU level override policy settings applied at the domain level.
- When using Advanced Audit Policy settings, be sure to enable Force advanced audit policy settings in order to override audit policy settings. To do so, go to Local Polices > Security Options, and enable Force audit policy subcategory settings.
- Run the Group Policy Results wizard found under the Group Policy Management Console to view a consolidated list of all audit policy settings that will be applied.
- When modifying an existing advanced audit policy, take a backup of the existing GPO so that it can be restored at any time. To take a back up, right-click on the relevant GPO and use the Back Up functionality.