Hello CMMC Reddit Community!

I'm working for small/medium company trying to check off CMMC requirements to become compliant.

I'm currently stuck on figuring out which Event ID's to monitor that indicate an admin has inputted their admin credentials. It doesn't seem like Windows has an Event ID that specifies when a person actually enter their admin credentials. The Event ID's I thought I could use are also triggered often by the system, so I'm not 100% I'm on the right path.

I was just wondering if anyone else has this type of log monitoring and if so what Event ID's are you looking for?

Thanks!