Daily Defender News
Aboutmerill.net
Microsoft Defender for Identity
Identity protection

Configure Windows event auditing - Microsoft Defender for Identity | Microsoft Learn

19 October 2026Doc update+17 / −16 lines

In brief

The documentation clarifies automatic Windows auditing for v3.x sensors, distinguishes it from automatic sensor activation, updates the listed auditing settings, changes the System event ID from 7045 to 4697, and directs administrators to use Certification Authority for CA auditing.

What Defender admins need to know

Use the revised guidance when configuring event auditing, especially for v3.x sensors and AD FS or AD CS environments.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Configure Windows event auditing for Defender for Identity sensors. Learn automatic, manual, and PowerShell methods to enable required audit policies. ms.date: 2026-10-06T00:18T00:00:00.0000000Z ms.topic: how-to ms.custom:

  • msecd-doc-authoring-1015

Configure Windows event auditing - Microsoft Defender for Identity | Microsoft Learn

Configure Windows event auditing to enable Defender for Identity detections. The sensor parses specific Windows event logs from your domain controllers, AD FS servers, AD CS servers,Active Directory Federation Services (AD FS), Active Directory Certificate Services (AD CS), and Microsoft Entra Connect servers. For the correct events to be audited and included in the Windows event log, these servers need the correct advanced audit policy settings.

Configure auditing using one of these methods:

  • Automatic configuration for sensor v3.x on domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers (recommended)
  • Manual configuration for sensor v2.x sensors, or if you opted out offor v3.x sensors when automatic Windows auditing is turned off
  • PowerShell configuration as an alternative to manual configuration
  • Required Windows events for all server types

Defender for Identity generates health alerts when it detects incorrect Windows event auditing configurations. For more information, see Microsoft Defender for Identity health alerts.

Configure Defender for Identity to collect Windows events automatically

If you're deploying the Defender for Identity sensorFor v3.x,x sensors, use automatic Windows auditing. This approach requires no manual configuration and handles all auditing settingsto configure supported auditing settings. Complete the additional steps for you.AD FS or AD CS, as applicable.

Control automatic Windows auditing

When Automatic sensor v3.x activation and Automatic Windows auditing configuration are enabled, Defender for Identity automatically activates sensor v3.x and configures Windows auditing on eligible domain controllers, AD FS, AD CS, or Microsoft Entra Connect servers that you onboard to Defender for Endpoint. The servers must run Windows Server 2019 or later.

Automatic sensor activation and automatic Windows auditing have separate controls. To enable automatic Windows auditing in the Defender portal,for v3.x sensors, complete the following steps:

  1. In the Microsoft Defender portal, go to Settings, and then Identities.
  2. In the General section, select Advanced features.

What automatic auditing configures

When enabled, the v3.x sensor automatically:

  • Checks current Windows event auditing configuration.

  • Identifies any gaps in the configuration.

  • Applies any necessary changes, including all of the steps in the manual configuration:supported auditing settings:

    • Directory services advanced auditing: Configures the required Windows advanced audit policies on the local system.
    • NTLM auditing: Configures the required NTLM auditing settings.
    • Domain object auditing: Adds audit entries to the domain root object's System Access Control List (SACL) to enable required directory service auditing.
    • NTLM auditing: Uses standard Windows Registry APIs to configure the required NTLM auditing registry values.
    • Domain objectConfiguration container auditing: Modifies the SACL on the Configuration partition to capture changes to directory service configuration objects.
    • AD FS auditing: Automatically configures the following settings:
      • Object-level auditing on the AD FS configuration container: Adds audit entries to the object's System Access Control List (SACL) of the AD FS configuration container, to enable auditing of AD FS-related directory objects.
      • Group Policy for event auditing: Configures the Audit Application Generated advanced audit policy (Success and Failure) on the local system by using the Windows Local Security Authority (LSA) audit policy APIs under the sensor's local system account.system.
      • Other AD FS auditing settings aren't included in automatic auditing and remain manual, such as AD FS event auditing in AD FS Management and verbose logging for AD FS events.
    • AD CS auditing: Writes the required value to the certificate authority (CA) audit filter in the CA's registry configuration. Automatic auditing modifies an existing audit filter but doesn't create one, so the CA must already have an audit filter configured. The new value takes effect after the Certificate Services (certsvc) service restarts. Until the service restarts, Defender for Identity raises a health alert that prompts you to restart it.
    • Microsoft Entra Connect auditing: Configures the Audit Logon advanced audit policy (Success and Failure) on Microsoft Entra Connect servers by using the Windows LSA audit policy APIs.servers.
    • Windows audit policy: Configures the local Windows audit policies using the Windows LSA audit policy APIs.policies.

  • Applies auditing settings directly to the local system policy of the server.

  • Runs once every 24 hours.

      | **Account Management** | **Audit Security Group Management**^Failure auditing note^ | 4728, 4729, 4730, 4732, 4733, 4756, 4757, 4758 |
  | **Account Management** | **Audit User Account Management** | 4726 |
  | **DS Access** | **Audit Directory Service Changes**^See note^ | 5136 |
  | **System** | **Audit Security System Extension**^See note^ | 70454697 |
  | **DS Access** | **Audit Directory Service Access** | 4662 - For this event, you must also configure domain object auditing. |

  Note

Restart-Service certsvc


- **To configure CA auditing in the Defender portal:by using Certification Authority:**

    1. Select **Start** > **Certification Authority (MMC Desktop application)**. Right-click your CA's name and select **Properties**.