if you have the ITSI, there are many Use Cases already available for Windows OS.
If you haven't the ITSI, I hint to install the Splunk App for Windows Infrastructure that contains many dashboards.
In addition, it's possible to implement using Windows logs:
login, logout and logfails,
extract server configurations,
excessive use of resources (CPUs, RAM, HDs, etc...)
Your question should be send to a Windows administrator not to a Splunk developer: ask to a Windows administrator what he needs and realize this with Splunk.
In addition you could ask to a Security Manager what are the security Use Cases he needs: brute force, non active users, etc...
At the end, see in apps.splunk.com if there are Apps that are interesting for you and start from them.