Direct answer
Choose audit categories for the security questions your team needs to answer, inspect the effective policy on a representative device, and verify that a safe test event reaches the intended log and collection system.
Define investigation questions
Decide which events the team needs, such as successful and failed sign-ins or changes to sensitive account privileges. Specify device groups, retention needs, privacy constraints and who is responsible for reviewing alerts before enabling additional collection.
Inspect effective audit settings
Compare effective audit policy with the organization's baseline, taking into account advanced subcategories and management policy. Record the device, policy source and time. An assigned setting in a console does not establish that the endpoint has processed it.
Reference: Microsoft: Security audit policy recommendations.
Generate a controlled example
With authorization, perform a harmless test that should produce the relevant event, such as a successful sign-in by a dedicated test account. Check the local Security log and any central collector for the expected event, timestamp and device identity. Avoid intentional lockouts or testing against real user accounts.
Check collection and retention
Verify that log forwarding, time synchronization, access restrictions and retention suit the investigation. Record missing devices and collection delays. Excessive volume can overwrite local logs or overwhelm a collector, so pilot changes and confirm capacity with the operations team.
Assessment limits
An event policy only records events covered by its settings and available instrumentation. A successful test does not establish complete collection across the fleet or prove that alerts are reviewed.
Frequently asked questions
Does enabling audit policy guarantee central collection?
No. Confirm the local event, forwarding path, collector and access separately.
Should every audit category be enabled everywhere?
Choose settings based on investigation needs and capacity, then test their volume and usefulness.
Can a missing event prove an action did not occur?
No. Policy, permissions, forwarding, retention or device availability may have prevented the event from being observed.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.