Logging policy
While the company had enabled audit logging on the active directory, the company had not defined a policy or standard on logging requirements.
Furthermore, some logging parameters were not configured in line with leading security practice.