Troubleshooting

#	Error	Cause	Resolution
1	The network path was not found	Target unreachable or no access to ADMIN$ share	Verify connectivity; ensure Domain Data Collection Account can access \\<machine>\ADMIN$
2	Couldn't copy ADAuditPlusAgent.msi/ Access Denied	Insufficient rights to ADMIN$ or share connection limit reached	Grant write access to ADMIN$; increase share limit via Shared Folders > Shares > ADMIN$ > Properties > User Limit
3	Another installation is already in progress (0x652)	Another MSI installer is running	Wait for it to complete, or run: taskkill /im msiexec.exe /f
4	The system cannot find the file specified (0x2)	MSI file not present on endpoint	Verify the MSI file exists in %SYSTEMDRIVE%\Windows and the Domain Data Collection Account has write access
5	Fatal error occurred (0x643)	Missing .NET Framework 4.5+, MSI conflict, or insufficient permissions	Install .NET 4.5+; re-register MSI: msiexec /unregister then msiexec /regserver
6	"RemCom.exe" is not recognized	Antivirus deleted the file	Add remcom.exe to AV exclusions on the ADAudit Plus server. Contact support if file is missing.
7	Could not install client software	Network timeout during installation	Verify stable connectivity and retry
8	Could not connect to the machine	Target unreachable	Test with ping; resolve DNS/routing/firewall issues
9	Initiating connection to remote service failed	Remote Registry service disabled or insufficient rights	Enable Remote Registry service; ensure the Domain Data Collection Account can create services on the endpoint
10	Logon failure: target account name is incorrect	Domain Data Collection Account is locked, disabled, or password changed	Verify account status; update credentials in Domain Settings > Modify Credentials
11	Logon failure: unknown user name or bad password	Incorrect credentials	Update credentials in Domain Settings > Modify Credentials
12	Could not start remote service	Account lacks privileges to start services	Ensure Domain Data Collection Account is Domain Admin (for console-based install)
13	Another version has already installed (0x666)	Existing agent version present	Uninstall the existing agent first via Configuration > Agent Management > Uninstall
14	Product is uninstalled (0x64E)	Agent was previously uninstalled but registry remnants remain	Reinstall the agent via the ADAudit Plus console
15	Incorrect function	System reboot during installation or insufficient disk space	Ensure no shutdown occurs during installation; verify free disk space
16	Hexadecimal value 0x05 is an invalid character	Agent unable to read event logs due to encoding anomalies	Upgrade to build 6085 or later. If issue persists, contact support with agent logs.

Agent communication issues (HTTPS)

If the agent is installed but not communicating with the server, follow this workflow:

Step 1: Check NAT configuration

Navigate to Admin > General Settings > Connection > NAT. If NAT is configured, the agent must use the NAT FQDN and NAT port.

Step 2: Browser connectivity test

On the agent machine, open a browser and navigate to:

NAT Configured	No NAT
https://<NAT_FQDN>:<NAT_Port>	https://<ServerName>:8555

Expected: ADAudit Plus login page loads (certificate warnings can be bypassed).

Step 3: Test port reachability (PowerShell)

# No NAT:

Test-NetConnection -ComputerName <ServerName> -Port 8444

# With NAT:

Test-NetConnection -ComputerName <NAT_FQDN> -Port <NAT_Port>

Expected: TcpTestSucceeded : True. If False, fix firewall, routing, or proxy restrictions.

Step 4: Verify registry settings

On the agent machine, open Registry Editor and check:

HKEY_LOCAL_MACHINE\SOFTWARE\ManageEngine\ADAudit Plus Agent\ServerInfo

Verify: ServerFQDN, ServerName, Port (or NATPort), ServerIP, OrgAccessKey. If NAT is enabled, ServerFQDN must match the NAT FQDN exactly.

Step 5: Restart the agent service

Open Services (services.msc) > find ADAudit Plus Agent > Restart. Wait one to two minutes, then check status in Configuration > Agent Management.

Step 6: Check agent logs

Review logs at C:\ManageEngine\ADAudit Plus Agent\logs for specific error details.

Server-to-agent issues (RPC)

RPC issues affect only console-based management (install, uninstall, start, stop, upgrade). If using GPO/Intune/SCCM/Endpoint Central, RPC is not required.

Verify ADMIN$ access:

From the ADAudit Plus server (logged in as the Domain Data Collection Account):

\\<TargetMachine>\ADMIN$

If access is denied, update credentials in Domain Settings.

Verify remote Event Viewer access:

From the ADAudit Plus server, open Event Viewer > right-click Event Viewer (Local) > Connect to Another Computer > enter the target machine name. If logs load, RPC is working.

Check agent status in UI:

In Configuration > Agent Management, status values like "Install Failed", "Uninstall Failed", "Start/Stop Failed", or "Upgrade Failed" indicate RPC failures (not HTTPS).

Deployment Method	RPC Needed?
Install/manage from ADAudit Plus console	Yes
GPO/SCCM/Intune/Endpoint Central	No
Normal event forwarding only	No

Frequently asked questions

Does the agent require a specific ADAudit Plus license?

No. The agent is included in all editions (Free, Standard, Professional). No separate license or add-on is required.

Does the agent modify anything on the endpoint?

No. The agent only reads the Windows Security event log and forwards events to the server. It does not modify system settings, audit policies, or files.

Can I deploy the agent without Domain Admin privileges?

Yes. Use any of the manual deployment methods (Intune, GPO, Endpoint Central, command line). Domain Admin is only required for console-based automatic installation.

What happens if the agent loses connectivity to the server?

The agent caches events locally in the EventData directory (default: 2GB). When connectivity is restored, cached events are forwarded automatically. If the cache fills up, event collection pauses until space is freed.

Does the agent auto-upgrade when I update ADAudit Plus?

If self-upgrade is enabled (in Admin > Agent Settings), the agent checks daily for new versions and upgrades automatically over HTTPS. No Domain Admin or RPC required.

Do I need to open RPC ports for the agent?

Only if you manage agents directly from the ADAudit Plus console (install, uninstall, upgrade, start/stop). If you deploy via Intune, GPO, SCCM, or Endpoint Central, the agent communicates via HTTPS only—no RPC ports needed.

What ports does the agent use?

Primary: TCP 8555 (HTTPS). Fallback: TCP 8444 (HTTPS) and TCP 8081 (HTTP). With NAT, the agent uses the NAT-configured port.

Can an older agent version work with a newer ADAudit Plus server?

Yes. Older agents are compatible with newer servers. However, enabling self-upgrade is recommended to keep agents current and receive the latest security and performance improvements.

Where are the agent logs located?

• Runtime logs: C:\ManageEngine\ADAudit Plus Agent\logs
• Installation log: C:\Windows\Temp\ADAuditPlusAgentInstall.log (if verbose logging was enabled during install)

Is a reboot required after agent installation or uninstallation?

No. The agent starts immediately after installation and stops immediately after uninstallation. No reboot is required.