Event Types and Objects Monitored for AD FS Servers

For Active Directory Federation Services (AD FS) servers, Netwrix Auditor can collect audit data on the events and configuration objects listed below.

Event type Action Details

AD FS logon (intranet)

Failed Logon

Cause (for failed attempts)
AD FS logon (extranet) Successful Logon Authentication methods (for Successful attempts)

Configuration information can be collected for the following objects:

  • AD FS servers included in the farm
  • Application Groups settings
  • Authentication Method names
  • Relying Party Trusts settings
  • Scope Descriptions