Нашел, оставлю ссылку тут, может кому то пригодится
https://learn.microsoft.com/ru-ru/de...d-ad-cs-events
Required AD CS events
The following events are required for AD CS servers:
4870: Certificate Services revoked a certificate
4882: The security permissions for Certificate Services changed
4885: The audit filter for Certificate Services changed
4887: Certificate Services approved a certificate request and issued a certificate
4888: Certificate Services denied a certificate request
4890: The certificate manager settings for Certificate Services changed
4896: One or more rows have been deleted from the certificate database
