Overview

    Purpose of this guide

    This guide explains how to prepare ADAudit Plus and your Active Directory environment for real-time Active Directory auditing. Follow this setup workflow before using Active Directory audit reports:

    • Configure the Active Directory domain and domain controllers in ADAudit Plus.
    • Configure Windows audit policies on domain controllers.
    • Configure object-level auditing (SACL) for Active Directory objects.
    • Configure Security event log retention and size.
    • Verify that the expected Windows events are generated and collected.

    Note For account concepts and least-privilege requirements, see Accounts & Privileges Overview and Agentless privileges for Active Directory and GPO auditing.

    What ADAudit Plus audits in Active Directory

    ADAudit Plus helps audit changes and activities in on-premises Active Directory, including:

    • User account creation, deletion, modification, enable or disable, password changes, and password resets
    • Group creation, deletion, membership changes, and group property changes
    • Computer account changes
    • Organizational unit (OU) changes
    • Group Policy Object (GPO) creation, deletion, modification, link changes, and settings changes
    • Domain policy changes
    • Active Directory permission changes
    • Schema and configuration partition changes
    • Active-Directory-integrated DNS zone and record changes
    • Logon, failed logon, account lockout, Kerberos, and other authentication-related events

    Active Directory contexts covered

    ADAudit Plus audits activities across the following major Active Directory contexts:

    Active Directory context What it contains Why it matters for auditing
    Domain naming context Users, computers, groups, OUs, contacts, and other domain objects Required for user, group, computer, OU, contact, permission, and domain object change auditing
    Schema context Active Directory schema objects and definitions Required for schema change auditing
    Configuration context Sites, subnets, services, configuration objects, and Active Directory DNS-related objects Required for configuration, topology, and Active-Directory-integrated DNS auditing