Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for AD FS auditing so you can monitor federated authentication activity, review AD FS logon success and failure, and investigate extranet lockout events from a single console.

Follow this workflow before using AD FS audit reports for operations, security review, or troubleshooting:

1. Decide whether the AD FS role is installed on a Domain Controller or on a Windows member server.
2. Configure the correct monitored system in the ADAudit Plus web console.
3. Configure the required Windows audit policies.
4. Enable auditing in the AD FS management console.
5. Configure claim rules for each relying party that you want to audit in detail.
6. Verify that AD FS events are written to the Windows Security log and collected by ADAudit Plus.

Note: If AD FS is installed on a Domain Controller, use the Domain Controller configuration workflow. If AD FS is installed on a Windows member server, use the member server workflow and confirm the required Member Servers licensing and privileges.

What ADAudit Plus audits on AD FS servers

ADAudit Plus helps you audit federated authentication activity recorded by AD FS, including:

• Successful federation authentications.
• Failed federation authentications.
• Unauthorized or rejected authentication attempts.
• Extranet lockout activity.
• Relying-party-specific authentication activity.
• Context fields such as UPN, Primary SID, client IP, proxy, forwarded client IP, and whether the request originated from inside the corporate network when the required claim rules are present.

This activity is presented in the product console under the AD FS Sign-In Activity report, which tracks:

• Successful Sign-Ins — federation authentications that completed successfully.
• Failed Sign-Ins — federation authentications that were rejected or failed.
• Extranet Lockout Events — soft lockout activity for users authenticating through an AD FS proxy or Web Application Proxy.

Common Windows Security event examples associated with AD FS auditing include Event IDs 1200, 1201, 1202, 410, and 411 on AD FS 2016 and later, and 403, 412, 500, and 501 on legacy AD FS versions. See Data flow and architecture for the full event ID reference.

Tip: Use AD FS auditing when you need visibility into authentication activity for federated applications, internet-facing sign-ins, or AD FS lockout behavior that is not visible in standard Windows member server reports alone.

Supported versions

Use the following support guidance when planning AD FS auditing.

Component	Supported version guidance
AD FS	AD FS 2.0 and above, including the latest AD FS release
Windows Server hosting AD FS	Windows Server 2008 / 2008 R2, 2012 / 2012 R2, 2016, 2019, 2022, and 2025
Legacy audit policy reference	Windows Server 2003 and earlier are retained in this guide only as a historical audit-policy reference

Note: Windows Server 2019, 2022, and 2025 are confirmed supported for AD FS auditing, consistent with the current Windows Server guide set.