Auditing and monitoring Active Directory using inbuilt Windows tools and techniques
Microsoft does have inbuilt features and tools to monitor/audit Active Directory environments. In this section, we are going to review these features and tools and see how we can use them efficiently.
Windows Event Viewer
As an engineer, I am sure you are well aware of Windows Event Viewer. It is a built-in tool which can be used to view and filter event logs on a local or remote computer. Events in there are generated by the operating system, services, server roles, and applications. This is the most commonly used tool in Windows systems for auditing and troubleshooting purposes.
Note
We also can write custom events to event logs. This is useful if you plan to run a script or action based on a particular event ID. This can be done using the Write-Eventlog cmdlet.
As shown in the following screenshot, Windows Event Viewer (Local) has four different categories to group event logs:
Custom views
Event Viewer allows...
