Can someone recommend Window Security Auditing Best Practices?

What size is your organization? Running mutilple servers, domains, etc? When you turn on auditing you could/will slow down your server(s) and logs files will get large.

Are you looking to lock down your system? Prevent users from logging on durning certian times? if so this can be set per user in the AD at the per user level and / or the group policy level.

Firstly, Logon and Logoff audit 'events' are saved in the Security log and there are two steps to performing auditing.
You create an audit policy in AD, then enable auditing on the object.
"Audit logon events" makes a log entry when a user logs on interactively (i.e., at the local keyboard and screen) or remotely (i.e., from over the network). The Logon Type field in the event's description contains a number that specifies the logon's nature: interactive (2), network (3), batch (4), service (5), unlocked workstation (7), network logon using a cleartext password (8), or impersonated logons (9).
The "Audit Account Logon Event" generates an event every time a user connects to that server across the network.
For this reason, it must be set on "every" DC and the log size set to approx 10-20Mb.
It is easier (and best practise) to just audit unsuccessful account logon events as these will show where unauthorised logons are being attempted, or where a user is forgetting their password.

Turning on ALL auditing will be counter-productive unless you really need it. The log files can grow out of control very quickly.