I am part of an internal software development group for an enterprise. We are being asked to build an Active Directory management web application. 1 of the primary reasons is the need to generate audit logs for operations that users do such as creating/deleteing objects, updating attributes, adding/removing members, etc.
My initial position is that all this functionality is already available in so many tools, such as the active directory users and groups snap in, why not just report on the domain controller logs and call it a day.
My understanding is that the domain control logs everything to the event log. Due to the amount of entries, our logs have a 2 day or so retention window, and because of the vast types of operations being logged getting the specific events we want is almost like finding a needle in a haystack.
Rather than building an application just so we can include our own audit logging in it, is there configuration or reporting that we can employ on the domain controller to make the audit logging more usable?