How to enable computer activity auditing

Perform the following actions on the domain controller (DC):

1. Press Start, search for, and open the Group Policy Management Console, or run the command gpmc.msc.

2. Right-click the domain or organizational unit (OU) that you want to audit, and click Create a GPO in this domain, and Link it here. If you have already created a Group Policy Object (GPO), go to step 4.

3. Name the GPO as appropriate.
4. Right-click the GPO and choose Edit.

5. In the Group Policy Management Editor, in the left pane, navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Audit Policy.

6. In the right pane, double-click Audit system events, and check the boxes labeled Define these policy settings, Success, and Failure.

7. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → System.

8. In the right pane, double-click Audit Security State Change, and check the boxes labeled Configure the following audit events, Success, and Failure.

9. Click Apply, then OK.
10. Go back to the Group Policy Management Console, and in the left pane, right-click the desired OU in which the GPO was linked and click Group Policy Update. This step makes sure the new Group Policy settings are applied instantly instead of waiting for the next scheduled refresh.

Steps to view these events using the Event Viewer

Once the steps above are complete, events will be stored in the event log. This can be viewed in the Event Viewer by following the steps below:

1. Press Start, search for Event Viewer, and click to open it.
2. In the Event Viewer window, in the left pane, navigate to Windows Logs → Security.
3. Here, you will find a list of all the security events that are logged in the system.

4. In the right pane, under Security, click Filter Current Log.

1. In the pop-up window, enter the desired Event ID* in the field labeled <All Event IDs→.

*The following Event IDs are generated for the given events:

6. Click OK. This will provide a list of occurrences of the entered Event ID.
7. Double-click the Event ID to view its properties (description).

The method above is unrealistic when you have to deal with thousands of computers in an organization, as an administrator would have to manually look up each event to view its details.

Monitoring computer activity the easy way using ADAudit Plus

ADAudit Plus, a comprehensive AD auditing tool, enables admins to effortlessly audit computer start up, shutdown, and every other change made to AD objects and their attributes.