Windows records security events only for the categories you enable. Default settings capture some logons, but miss much of what you need to investigate an incident: which process ran, who changed which account, what a PowerShell script did. Here’s how to enable useful auditing on Windows 10/11 and Windows Server.

1. Use Advanced Audit Policy

Open Local Security Policy (secpol.msc) → Advanced Audit Policy Configuration → System Audit Policies. (On domain-joined machines, configure the same settings via Group Policy.)

Recommended baseline:

Category → Subcategory Audit
Account Logon → Credential Validation Success, Failure
Account Management → User Account Management Success, Failure
Account Management → Security Group Management Success
Detailed Tracking → Process Creation Success
Logon/Logoff → Logon Success, Failure
Logon/Logoff → Special Logon Success
Logon/Logoff → Account Lockout Failure
Object Access → Removable Storage Success, Failure (if relevant)
Policy Change → Audit Policy Change Success
Privilege Use → Sensitive Privilege Use Failure
System → Security State Change Success

Or from an elevated prompt:

auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable
auditpol /get /category:*

2. Include command lines in process events

Process creation events (4688) are far more useful with the full command line:

Group Policy: Computer Configuration → Administrative Templates → System → Audit Process Creation → Include command line in process creation events → Enabled.

Or:

reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

3. PowerShell logging

Attackers love PowerShell. Enable Script Block Logging:

Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → Turn on PowerShell Script Block Logging → Enabled.

Events appear in Applications and Services Logs → Microsoft → Windows → PowerShell → Operational (Event ID 4104).

4. Make the logs big enough

The default Security log size fills quickly on busy servers, overwriting old events.

wevtutil sl Security /ms:1073741824
wevtutil sl "Microsoft-Windows-PowerShell/Operational" /ms:268435456

(1 GB for Security, 256 MB for PowerShell — adjust to your disk.)

5. Event IDs worth knowing

ID Meaning
4624 / 4625 Successful / failed logon (check Logon Type: 10 = RDP, 3 = network)
4634 / 4647 Logoff
4672 Logon with administrative privileges
4688 New process created
4720 / 4726 User account created / deleted
4728 / 4732 Member added to a security group (e.g. Administrators)
4740 Account locked out
4719 Audit policy changed
1102 Security log cleared — always investigate
7045 (System log) New service installed

6. Query events with PowerShell

Failed RDP logons in the last 24 hours, by source IP:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} |
  ForEach-Object { ([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'IpAddress' } |
  Group-Object '#text' | Sort-Object Count -Descending | Select-Object -First 10 Count, Name

Hundreds of failures from many IPs means RDP is exposed to the internet — restrict it with Windows firewall rules.

7. Send logs off the server

Logs on a compromised machine can be deleted. Forward them:

  • Windows Event Forwarding to a collector server (built in).
  • An agent (e.g. Winlogbeat, NXLog, Wazuh) sending to a SIEM or log platform.

Even a small Linux VPS running a log collector is a big improvement over local-only logs.

Summary

Enable the advanced audit subcategories above, include command lines, turn on PowerShell script block logging, enlarge the logs and forward them elsewhere. Combined with RDP restrictions and updates, this makes a Windows VPS far easier to secure and investigate. Related: Microsoft Defender Offline scan.

  • Windows
  • Security
  • Logging