| name | configuring-windows-event-logging-for-detection |
| description | Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.
|
| domain | cybersecurity |
| subdomain | endpoint-security |
| tags | ["endpoint","windows-security","event-logging","audit-policy","detection-engineering"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"] |
Configuring Windows Event Logging for Detection
When to Use
Use this skill when:
- Configuring Windows Advanced Audit Policy for security monitoring
- Enabling process creation auditing with command line logging (Event 4688)
- Setting up logon/logoff auditing for authentication monitoring
- Sizing event log storage and forwarding to SIEM platforms
Do not use for Sysmon configuration (separate skill) or Linux audit logging.
Common Misconfigurations & Verification
- 4688 logged without command line: enabling the Process Creation subcategory is not enough —
ProcessCreationIncludeCmdLine_Enabled (HKLM...\Policies\System\Audit) must also be 1, or every 4688 lands with a blank CommandLine and near-zero detection value. Verify the registry value AND a sample event.
- Advanced audit policy overridden by basic: if "Force audit policy subcategory settings to override audit policy category settings" (SCENoApplyLegacyAuditPolicy) is not Enabled, legacy category settings win and your subcategories are ignored. Confirm with
auditpol /get /category:*, not the GPO editor.
- Subcategory shows "No Auditing" on the host: GPO can say Success/Failure while
auditpol on the endpoint shows No Auditing due to merge/precedence. Validate on the target, not the GPMC.
- WEF subscription inactive:
wecutil gr <subscription> must list source computers as Active; a created-but-empty subscription forwards nothing. Check the collector's ForwardedEvents channel is actually filling.
- Verify end-to-end: run Atomic Red Team T1059.001 (PowerShell) or spawn
cmd.exe /c whoami and confirm a 4688 with the full command line reaches the SIEM, and 4104 script-block text appears in Microsoft-Windows-PowerShell/Operational. Also raise the Security log above the 20 MB default or events roll before forwarding.
Prerequisites
- Windows Server or Windows 10/11 systems with Group Policy management access
- Active Directory environment with Group Policy Object (GPO) creation privileges
- SIEM platform configured to receive Windows Event Log forwarding
- Understanding of Windows security event IDs and audit categories
Workflow
Step 1: Configure Advanced Audit Policy via GPO
Computer Configuration → Windows Settings → Security Settings
→ Advanced Audit Policy Configuration → Audit Policies
Recommended settings:
Account Logon:
- Audit Credential Validation: Success, Failure
- Audit Kerberos Authentication: Success, Failure
Account Management:
- Audit Security Group Management: Success
- Audit User Account Management: Success, Failure
Logon/Logoff:
- Audit Logon: Success, Failure
- Audit Logoff: Success
- Audit Special Logon: Success
- Audit Other Logon/Logoff Events: Success, Failure
Object Access:
- Audit File Share: Success, Failure
- Audit Removable Storage: Success, Failure
- Audit SAM: Success
Policy Change:
- Audit Audit Policy Change: Success, Failure
- Audit Authentication Policy Change: Success
Privilege Use:
- Audit Sensitive Privilege Use: Success, Failure
Detailed Tracking:
- Audit Process Creation: Success
- Audit DPAPI Activity: Success, Failure
