ADFS Auditing Configuration on Windows Server

Updated Mar 11, 2024

NXLog for auditing ADFS

NXLog for auditing ADFS

Active Directory Federation Services (ADFS) is a software component that provides users with single sign-on (SSO) access to systems and applications located across organizational boundaries. You can enable auditing for ADFS and send audit logs to Arctic Wolf® using NXLog.

These operating systems are supported:

Windows Server 2012 R2
Windows Server 2016
Windows Server 2019

PowerShell commands for auditing ADFS

By default, basic auditing is enabled for ADFS. But, you can run these basic PowerShell commands to adjust the level of auditing for ADFS:

Note: You must run these commands on the primary ADFS server.

Run this command to log no more than five events for a single request:
```
Set-AdfsProperties -AuditLevel Basic
```
Run this command to disable log audit events:
```
Set-AdfsProperties -AuditLevel None
```
Run this command to log a significant number of events:
```
Set-AdfsProperties -AuditLevel Verbose
```
Run this command to view or verify the current auditing level:
```
Get-AdfsProperties
```

Run this command to turn on Extranet Lockout:

Set-AdfsProperties -EnableExtranetLockout $true -ExtranetLockoutThreshold 8 -ExtranetObservationWindow (new-timespan -Minutes 15)

Run this command to add block IP addresses to ADFS:

Set-AdfsProperties -AddBannedIps "1.2.3.4", "::3", "1.2.3.4/16"

Run this command to use the Windows Internal Database (WID) as the storage method for the ADFS configuration database:
```
Set-AdfsProperties -LogLevel `
((Get-AdfsProperties).LogLevel+'SuccessAudits','FailureAudits')
```

ADFS audit configuration in Group Policy

Based on Microsoft best practices, all Group Policy Objects (GPOs) that apply to ADFS servers should not apply to other servers. See Arctic Wolf Group Policy Object Advanced Audit Policy for more information. If the ADFS server is not also a domain controller (DC), some items do not apply.

Enable the ADFS service account

The ADFS service account is disabled by default.

Note: Events from the auditing levels above the service account are independent of the default options on the Events tab of the ADFS properties.

Click Start > Programs > Administrative Tools > Local Security Policy.

Tip: Microsoft recommends using the Local Security Policy application for this process.
Navigate to the Security Settings\Local Policies\User Rights Assignment folder, and then double-click Generate security audits.
On the Local Security Setting tab, verify that the ADFS service account is listed. If it is:
- Not listed — Click Add User or Group, add it to the list, and then click OK.
- Listed — Proceed to the next step.
Open a command prompt with administrator permissions.

Run this command to enable auditing:

auditpol.exe /set /subcategory:"Application Generated" /failure:enable /success:enable

Close the Local Security Policy window.
Click Start > Programs > Administrative Tools > ADFS Management to open the ADFS Management snap-in.
In the Actions pane, click Edit Federation Service Properties.
In the Federation Service Properties dialog, click the Events tab.
Select Success audits and Failure audits.

Note: Arctic Wolf recommends enabling Success audits and Failure audits on the ADFS Farm. To enable this, you must enable auditing using the Local Security Policy MMC snap-in.
Click OK.

ADFS logs for troubleshooting

These are the primary logs used for ADFS troubleshooting:

Administrative log — Provides high-level information for issues. This logging is enabled by default.
Trace log — Generates in a short amount of time. This logging is disabled by default.

Send ADFS logs to Arctic Wolf

Confirm that NXLog is installed on ADFS servers. See NXLog installation and version updates for more information.
Confirm that the nxlog.conf file for the Arctic Wolf Sensor, including Virtual Log Collectors (vLCs) or Virtual Sensors (vSensors), is installed in the same local area network.

Tip: The standard Arctic Wolf nxlog.conf file configuration used on your DC works for this process.
Confirm that NXLog is started.