How to Configure Advanced Audit Policy on Windows Server
Applies to: Windows Server 2019, 2022 and 2025, subject to installed updates and feature availability.
Advanced audit subcategories provide granular security events. Enable only useful categories and size logs to retain the evidence required.
Security controls should be piloted, monitored and reversible through console access. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Define monitoring and retention requirements.
- Forward critical events to a protected collector.
- Test event volume.
- Back up current audit policy.
Procedure
Step 1: Export current policy
Create a rollback file.
auditpol /backup /file:C:\Temp\audit-policy.csvStep 2: Review categories
List effective audit settings.
auditpol /get /category:*Step 3: Enable logon auditing
Record success and failure.
auditpol /set /subcategory:'Logon' /success:enable /failure:enableStep 4: Enable account-management auditing
Record identity changes.
auditpol /set /subcategory:'User Account Management' /success:enable /failure:enableStep 5: Configure GPO enforcement
Use Advanced Audit Policy Configuration in a domain GPO to prevent local drift.
Step 6: Validate forwarding
Generate controlled test events and confirm collection.
Verification
Read effective policy and recent security events.
auditpol /get /category:*
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4624,4625,4720,4726;StartTime=(Get-Date).AddHours(-2)} -MaxEvents 50Rollback and recovery
Restore the captured policy with auditpol /restore and revert the governing GPO.
Security notes
Auditing without protected collection and review creates logs but not effective detection.
Official references
Explore Netcloud24 Canada.
