Auditing on the adfs container

Even though AD FS provides two primary logs such as the Admin Log and Trace Log for troubleshooting purposes, organizations can enable additional built-in auditing on their AD FS servers which is then consumed via the “Security” event channel and accessible under the "AD FS Auditing” event provider

To enable AD FS verbose auditing, run the following lines of Windows PowerShell in an elevated Windows PowerShell window or PowerShell ISE: Repeat the above line of Windows PowerShell on each AD FS server in the AD FS Farm

To enable the Auditing Policy, run the following command line in an elevated Command Prompt ( cmd

Security auditing Security auditing of the AD FS service account can sometimes help track issues with password updates, request/response logging, request content headers, and device registration results

Auditing of the AD FS service account is disabled by default

Enable security auditing