Auditing, Logging & Detection
AD auditing and detection: audit policy and event IDs
Configure Advanced Audit Policy, SACLs, and Windows Event Forwarding so you can actually see Kerberoasting, DCSync, and privilege escalation in AD.
Foundation
Guides tagged