Auditing Subcategories and Recommendations
Andrei Miroshnikov · 2018
This chapter discusses descriptions for advanced auditing subcategories and recommended settings for domain controllers, member servers, and workstations. The audit logon subcategory (part of the Logon/Logoff category) also provides information about local account logons, but to find out whether the account is local. Enabling audit credential validation events on member servers and workstations may help you to easily track local account authentications, but provides less information than audit logon subcategory events. The audit credential validation subcategory events on domain controllers provide a centralized way to monitor account logons in the domain, but these events don't provide enough details, especially because there is no information about the logon destination host. The chapter provides a complete list of events for this subcategory on official Microsoft sites. This subcategory has both audit success and audit failure events.