I'm building an Active Directory monitoring baseline and want to compare practical production setups. Which event IDs do you consider essential to monitor on domain controllers, and which ones have turned out to be too noisy to alert on? I'm especially interested in useful signals for NTP, AD replication, authentication, audit-policy changes, lockouts, and unexpected restarts.
2 Answers
For domain controllers, I prefer a relatively small, actionable alert set. Useful events to keep visible include unexpected startup or shutdown activity, 1102 when the Security log is cleared, 4719 for audit-policy changes, and 4740 for account lockouts. Replication alerts are usually less noisy when based on failures that persist over time instead of a single failed attempt.
A good starting point is to review the CIS Windows Server benchmark alongside the NIST guidance on event logging. From there, tune the list around your environment and only alert on events that lead to a concrete investigation or response.
When you say persistent replication failures, what are you tracking in practice—repeated failures over a time window, replication health counters, or a specific set of directory-service events?