I'm building a baseline for Active Directory monitoring and would like to compare practical production setups. Which event IDs do you consider essential on domain controllers, and which ones have turned out to be too noisy to alert on? I'm especially interested in security events, Kerberos, NTP, and AD replication health.
3 Answers
I’d also monitor the operational health of the domain controllers rather than treating every event as a security alert. Replication failures, time synchronization problems, and recurring directory-service errors are more useful when correlated over time. A sustained replication problem is generally more actionable than one isolated failure.
I try to keep the alert list focused on events that require action. Useful examples include 1102 for clearing the Security log, 4719 for audit policy changes, and 4740 for account lockouts. For unexpected restarts or shutdowns, look at events such as 6005, 6006, 6008, and 1074. For replication, alerting on a single failure is usually noisy, so tracking repeated or sustained failures tends to work better.
A good starting point is to compare your baseline with established security logging guidance, such as CIS recommendations and NIST event-logging guidance. Then tune it based on what your environment can actually investigate instead of enabling every possible alert.
For replication, do you track a particular event ID, or do you roll failures up over a time window before generating an alert?