Which Windows Event IDs Are Worth Monitoring on Domain Controllers?

A good starting point is to compare your baseline with established security logging guidance, such as CIS recommendations and NIST event-logging guidance. Then tune it based on what your environment can actually investigate instead of enabling every possible alert.

I try to keep the alert list focused on events that require action. Useful examples include 1102 for clearing the Security log, 4719 for audit policy changes, and 4740 for account lockouts. For unexpected restarts or shutdowns, look at events such as 6005, 6006, 6008, and 1074. For replication, alerting on a single failure is usually noisy, so tracking repeated or sustained failures tends to work better.

I’d also monitor the operational health of the domain controllers rather than treating every event as a security alert. Replication failures, time synchronization problems, and recurring directory-service errors are more useful when correlated over time. A sustained replication problem is generally more actionable than one isolated failure.

Kerberos is worth including in the baseline. Events such as 4768 and 4769 can help with unusual ticket activity, while 4771 and 4776 are useful for spotting repeated pre-authentication or credential-validation failures. These need thresholds and context, though, because normal service accounts and misconfigured applications can generate plenty of noise.