Windows Security Audit Policy and Event Log Investigation in Practice — Becoming an IT Team That Can Read Event 4625 (archived 2026-08-30)

Abstract

A practical guide for answering "please look into the failed sign-in logs." It covers the relationship between basic and advanced audit policy, the subcategories you should enable at minimum, how to read event IDs 4624/4625/4688, Security log capacity design, and extraction with Get-WinEvent. Archived version of https://comcomponent.com/en/blog/windows-security-audit-policy-guide/, as published on 2026-08-30. The live article is maintained and may change after this date. First published 2026-08-01.