Trace Appendix L - Events to Monitor across Active Directory and Windows DNS
Microsoft states: “The following table lists events that you should monitor in your environment, according to the recommendations provided in Monitoring Active Directory for Signs of Compromise.”
Read the guide