TABLE OF CONTENTS

• Overview
• Steps to Enable Windows Event

Overview

Sometimes during the configuration of Window AD, the Local Security Policy is disabled. We can enable the Local Security Policy using Group Policy Management.

Steps to Enable Windows Event

1. Go to Local Security Policy/Group management policy.
2. Find Local Security Policy
3. Go to "Local Policies" under "Security Settings" and select "Audit Policy":

   

4. Click on any of the events, say "Account Audit Logon":

5. 

6. Check "Success" and "Failures", then click "Apply"
7. Repeat the same for the following: 
   1. Audit account logon events
   2. Audit directory service access
   3. Audit object access
   4. Audit policy change
   5. Audit privilege use
   6. Audit system events
   7. Audit process tracking
      
      Note: It is not necessary to define the policy for: Audit account management
8. Open Command Prompt, once policies are enabled, and run the command gpupdate /force, to validate that the policies are enabled.
   
   For Group Policy Management, please refer to the link below:
   https://www.lepide.com/blog/audit-successful-logon-logoff-and-failed-logons-in-activedirectory/