1. Logon Types
Windows tags every logon event (4624 success, 4625 failed, 4634 logoff) with a numeric Logon Type that describes how the credential was presented. AD Audit Pro filters ingest by this number, so you can capture only the types you actually investigate.
Defaults
Interactive-shaped logons only. Network chatter (Type 3) and service/batch logons are dropped.
| Type | Name | Description | Default |
|---|---|---|---|
| 2 | Interactive | Physical console login (keyboard at the machine). | On |
| 3 | Network | File shares, SMB, RPC. High volume. Off by default. | Off |
| 4 | Batch | Scheduled tasks. Off by default. | Off |
| 5 | Service | Service startup. Off by default. | Off |
| 7 | Unlock | Workstation unlock after screen lock. | On |
| 8 | NetworkCleartext | Basic auth over network. Off by default. | Off |
| 9 | NewCredentials | runas /netonly. Off by default. |
Off |
| 10 | RemoteInteractive | RDP session. | On |
| 11 | CachedInteractive | Offline cached credentials (e.g. laptop off the domain). | On |
Turning on Type 3 (Network) can grow the Events table 10 to 50x on a busy file server or DC. Only enable it if you have a specific investigation that needs SMB or RPC logon detail.
2. Noisy AD Events
Handful of Security-log events that generate high volume on any healthy domain and rarely represent human activity. Off by default; toggle any of them on if your investigation needs them.
| Event ID | What it captures | Default |
|---|---|---|
| 4719 | Audit Policy Changed. Fires on every audit-policy GPO refresh on each DC, typically every 5 to 90 minutes per DC. Usually not useful unless you are actively investigating policy churn. | Off |
| 4723 / 4724 | Machine-account password changes and resets. Computer accounts rotate their own password automatically every 30 days by default. Admin-driven resets against them almost never represent human activity worth reporting. | Off |
| 5136 | DNS directory changes. AD-integrated DNS zones write 5136 events on every scavenging pass and tombstone. On a busy DNS-integrated environment this dominates 5136 volume. | Off |
| 5136 | Machine self-modifications. A computer acting on its own AD object: Windows Hello for Business key registration, LAPS password rotation, machine-password rotation, SPN and OS attribute updates. Background maintenance, not human activity. | Off |
3. Health Channels
Non-Security event log channels AD Audit Pro can subscribe to on each Domain Controller. All off by default because they are noisy on a healthy DC and most installs don't need them. Enable individually if you want the corresponding health report to populate.
| Channel | What it captures | Feeds report |
|---|---|---|
| Directory Service | Errors and warnings from NTDS, ADWS, DFSR, and other AD-related providers that write to this channel. | Errors & Warnings |
| DFS Replication | SYSVOL replication errors and warnings (DFSR service). | Errors & Warnings |
| DNS Server | DNS Server service errors and warnings on DCs that also run DNS. | Errors & Warnings |
| Active Directory Web Services | ADWS service errors and warnings. | Errors & Warnings |
| System | Restarts, shutdowns (1074, 6005, 6006, 6008, 41), service crashes (7031, 7034), and time-sync failures (24, 29, 36, 38, 50). | Restarts & Shutdowns, Service Failures, Time Sync |
| Microsoft-Windows-NTLM/Operational | Incoming NTLM authentication events (8001-8004). Requires the "Audit Incoming NTLM Traffic" GPO to be enabled on the DCs. | NTLM Usage |
Capture Errors only
A single toggle applies to every enabled health channel. Turn it on to capture only Level 2 (Error) events and drop Level 3 (Warning). Reduces volume significantly on chatty channels like Directory Service.
Health channels ride on the same per-DC subscription as the Security log. Enabling a channel adds one subscription per DC. Six DCs with three channels enabled means 18 additional live subscriptions.
4. Always Excluded (built-in)
Certain patterns are dropped at ingest and cannot be turned on. These are pure Windows noise that pollutes logon reports without ever answering a security question.
Logon events (4624, 4625, 4634, 4647) whose target is
SYSTEM, the local system account.*$, computer accounts (always end with$).DWM-*, Desktop Window Manager, one per active session.UMFD-*, User-Mode Font Driver, one per active session.
Applied to both the DC live subscription and the workstation poller, so these never reach the database in the first place.
Change filters
- Go to Settings > Event Filters.
- Search or scroll to the row you want to change.
- Click the Yes / No pill to flip the capture state.
- Click Save. Changes take effect immediately:
- DC watchers are torn down and rebuilt with the new filter set.
- The workstation poller re-reads filters at the start of every 5-minute cycle.
Filters only affect newly ingested events. Rows already in the database are unaffected and stay until retention purges them. To remove historical rows immediately, drop retention (Settings > Database) or delete them directly in SQL.