Portuguese Oncology Institute of Porto finds a reliable auditing solution in ADAudit Plus

Business challenges

• Critical monitoring needs: Any unknown or unauthorized change to users, groups, or systems could lead to significant disruptions or security breaches, underscoring the need for robust AD monitoring.
• Real-time alerting: To maintain IT continuity, IPO-Porto required an intuitive system capable of triggering real-time alerts via email or SMS for critical changes.
• Compliance requirements: To ensure compliance with IT regulatory mandates, it was required for IPO-Porto's administrative team to collect audit reports of the changes made in their AD environment

The problem

With Active Directory forming the backbone of IPO-Porto’s business operations, making real-time visibility into user, group, and system changes essential. According to Vitor Macedo, the security sysadmin at IPO-Porto, the lack of a reliable monitoring solution prior to ADAudit Plus posed challenges in detecting unauthorized changes or logon failures, leaving the organization vulnerable to potential threats.

Macedo also added that the change audits are necessary for the organization to achieve compliance with regulatory standards, including the GDPR. The need for an intuitive, scalable, and efficient solution became evident to meet operational security demands.

The solution

Since implementing ADAudit Plus, IPO-Porto has achieved unmatched visibility and control over its AD environment. IPO-Porto leverages ADAudit Plus to track changes across users, groups, and systems. With customizable and automated reports, the IT team was able to monitor domain admin group changes and other sensitive events, thereby making change auditing and compliance reporting more effective: "The [GPO] reports are very useful to know what was created, modified, and deleted. It is fundamental to fulfill GDPR compliance audits."

Furthermore, ADAudit Plus helps track logon failures, password issues, and changes to groups, folders, or files. This granular visibility has enabled IPO-Porto to swiftly identify and respond to potential threats or anomalies in the system. Macedo noted that ADAudit Plus' alert profiles gave his IT team a formidable edge, when it came to mitigating threats: "Depending on the change [in the AD], we trigger emails and [for] important events, we trigger SMS to SysAdmins." The intuitive interface and ease of management are standout features for IPO-Porto, with Macedo opining that "[ADAudit Plus'] intuitive and simple to manage [controls] is the main advantage."

ADAudit Plus has proven to be a valuable asset for maintaining the integrity of IPO-Porto's AD environment, with Macedo expressing "[We've been using ADAudit Plus] for the last 10 years it is of great value to our company. Sometimes we need to know who did the changes in one specific group or just one change to one user and with the ADAudit Plus this is very simple to accomplish." He added that "All companies need to have a solution like ADAudit Plus for monitoring their Active Directory"

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.