Configure auditing for ADFS

Active Directory Federated Services (ADFS) is a software component that provides users with single sign-on (SSO) access to systems and applications located across organizational boundaries. You can enable auditing for ADFS and send audit logs to Arctic Wolf® using NXLog.

Note: Based on Microsoft best practices, all Group Policy Objects (GPOs) that apply to ADFS servers should not apply to other servers. If the ADFS server is not also a domain controller (DC), some items do not apply.

These resources are required:

A supported operating system:
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019

Optional: Adjust the level of auditing for ADFS

By default, basic auditing is enabled for ADFS. But, you can run these basic PowerShell commands to adjust the level of auditing for ADFS:

On the primary ADFS server, run one or more of these commands:

Run this command to log no more than five events for a single request:
BASH
Set-AdfsProperties -AuditLevel Basic
```
Set-AdfsProperties -AuditLevel Basic
```
Run this command to disable log audit events:
BASH
Set-AdfsProperties -AuditLevel None
```
Set-AdfsProperties -AuditLevel None
```
Run this command to log a significant number of events:
BASH
Set-AdfsProperties -AuditLevel Verbose
```
Set-AdfsProperties -AuditLevel Verbose
```
Run this command to view or verify the current auditing level:
BASH
Get-AdfsProperties
```
Get-AdfsProperties
```
Run this command to turn on Extranet Lockout:
BASH
Set-AdfsProperties -EnableExtranetLockout $true -ExtranetLockoutThreshold 8 -ExtranetObservationWindow (new-timespan -Minutes 15)
```
Set-AdfsProperties -EnableExtranetLockout $true -ExtranetLockoutThreshold 8 -ExtranetObservationWindow (new-timespan -Minutes 15)
```
Run this command to add block IP addresses to ADFS:
BASH
Set-AdfsProperties -AddBannedIps "1.2.3.4", "::3", "1.2.3.4/16"
```
Set-AdfsProperties -AddBannedIps "1.2.3.4", "::3", "1.2.3.4/16"
```
Run this command to use the Windows Internal Database (WID) as the storage method for the ADFS configuration database:
BASH
Set-AdfsProperties -LogLevel ` ((Get-AdfsProperties).LogLevel+'SuccessAudits','FailureAudits')
```
Set-AdfsProperties -LogLevel `
((Get-AdfsProperties).LogLevel+'SuccessAudits','FailureAudits')
```

Enable the ADFS service account

The ADFS service account is disabled by default.

Note:

Events from the auditing levels above the service account are independent of the default options on the Events tab of the ADFS properties.

Click Start > Programs > Administrative Tools > Local Security Policy.

Tip:
Microsoft recommends using the Local Security Policy application for this process.
Navigate to the Security Settings\Local Policies\User Rights Assignment folder, and then double-click Generate security audits.
On the Local Security Setting tab, verify that the ADFS service account is listed. If it is:
- Not listed — Click Add User or Group, add it to the list, and then click OK.
- Listed — Proceed to the next step.
Open a command prompt with administrator permissions.
Run this command to enable auditing:
BASH
auditpol.exe /set /subcategory:"Application Generated" /failure:enable /success:enable
```
auditpol.exe /set /subcategory:"Application Generated" /failure:enable /success:enable
```
Close the Local Security Policy window.
Click Start > Programs > Administrative Tools > ADFS Management to open the ADFS Management snap-in.
In the Actions pane, click Edit Federation Service Properties.
In the Federation Service Properties dialog, click the Events tab.
Select Success audits and Failure audits.

Note:
Arctic Wolf recommends enabling Success audits and Failure audits on the ADFS Farm. To enable this, you must enable auditing using the Local Security Policy MMC snap-in.
Click OK.

Send ADFS logs to Arctic Wolf

Confirm that NXLog is installed on ADFS servers.
For more information, see Install NXLog.
Confirm that the nxlog.conf file for the Arctic Wolf Sensor, including Virtual Log Collector (vLC) or Virtual Sensor (vSensor), is installed in the same local area network.

Tip:
The standard Arctic Wolf nxlog.conf file configuration used on your DC works for this process.
Confirm that NXLog is started.