Microsoft does have inbuilt features and tools to monitor/audit Active Directory environments. In this section, we are going to review these features and tools and see how we can use them efficiently.
Auditing and monitoring Active Directory using inbuilt Windows tools and techniques
Windows Event Viewer
As an engineer, I am sure you are well aware of Windows Event Viewer. It is a built-in tool which can be used to view and filter event logs on a local or remote computer. Events in there are generated by the operating system, services, server roles, and applications. This is the most commonly used tool in Windows systems for auditing and troubleshooting purposes.
We also can write custom events to event logs. This is useful...
