Simple (better) local check; Monitor windows event logs\ID's

Maybe that is true, but for us its way to much information that is being sent to check mk.
Which we want to minimalize because of performance.

So this is the best option in the situaties we have.