Windows logging is absoloutly critical, and the brilliant work from dfir-blog.com shows in great detail how to fine tune it.

Use this - http://dfir-blog.com/2015/10/11/protecting-windows-networks-essential-logging/
In conjunction with this - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/56016bffe4b0a6f05d1832ab/1442933759511/Windows+Logging+Cheat+Sheet_Sept_2015.pdf

Thanks to dfir-blog.com & MalwareArchaeology.com