Hi Guys, we're in the midst of reviewing our Active Directory auditing settings, and were wondering if anyone had a list that enumerated the optimal set of events to audit in our Active Directory?

As you may be familiar, the risk of auditing too much is that our event logs fill up and roll over sooner than we wish them too, and the risk of not auditing all the right events is that we sometimes tend to miss important changes.

If anyone has attempted to come up with such a list, would really if you'd be willing to share your input or provide some guidance.

Thanks much in advance.