Active Directory logon audit

Active Directory (AD) logon auditing with ADAudit Plus

What is AD logon auditing?

AD logon auditing is the continuous collection and analysis of authentication events across a Windows domain. Every time a user, service account, or computer authenticates against a DC, Windows generates a security event. Those events (successful logons, failed attempts, lockouts, session terminations) form the raw material for understanding who has access to your environment and how that access is being used. Without a consistent audit of these events, suspicious patterns go unnoticed until a breach is already in progress.

ADAudit Plus centralizes logon event data from every DC, member server, and workstation in your environment. Rather than requiring administrators to search Security event logs on individual DCs, ADAudit Plus aggregates, correlates, and surfaces logon data through pre-configured reports, UBA-driven anomaly detection, and real-time alerts. The result is continuous visibility into authentication activity, with the context needed to act on what you find.

Key logon audit data captured by ADAudit Plus

Monitor logon activity across your environment

Visibility into logon activity only matters if it covers every tier of your environment. ADAudit Plus captures authentication and logon events from across your domain.

• Report on all authentication activity grouped by DC.
• Trace all logon events from a specific IP address across your entire domain without querying individual security logs.
• Detect users with sessions on more than one machine at the same time, a flag for credential sharing or lateral movement.
• Review each user's last logon time on every workstation accessed without relying on the lastLogon attribute, which does not replicate between DCs.

 

 

See which accounts have active or recent sessions on more than one machine, with the machine names, logon times, and source IP addresses for each session.

Audit failed logons and detect brute-force activity

A single failed logon is noise. A pattern of failures against the same account, the same source IP, or the same DC at the same time is a signal. ADAudit Plus separates these cases. It also builds a per-user baseline to surface anomalies that fall below fixed thresholds.

• Failures caused by bad passwords are reported separately from bad username failures; a spike in bad username failures points to password spray activity.
• Logon failures are grouped by user so you can see how many failures a single account has accumulated across all DCs in a given period.
• Unusual Volume of Logon Failure flags a spike in failures for a specific user against their own learned baseline, not a fixed domain threshold.
• First Time Host Accessed by User flags the first-ever logon to a machine that user has never accessed before.

 

 

Gain detailed visibility into failed logon attempts across your domain, including the user name, client IP, client host, DC, logon time, and failure reason.

Detect logon-based attacks

Several of the most damaging AD attack techniques abuse the Kerberos authentication stack and NTLM credential handling. ADAudit Plus identifies them through the Attack Surface Analyzer.

• Kerberoasting, Golden Ticket, Silver Ticket, pass-the-hash, pass-the-ticket, brute force, and password spray attacks are all detected through the Attack Surface Analyzer.
• When the Attack Surface Analyzer identifies one of these techniques, it shows you when the attack occurred, which account was targeted, which machine was used, and a timeline of threat actor activity before and after detection.

 

 

Spot pass-the-ticket attacks, with the affected account, the source server, the domain, and the exact time, recorded in a single view.

Extend logon auditing to hybrid and cloud environments

Most environments today have authentication activity in both on-premises AD and Entra ID. ADAudit Plus covers both from a single console, so you are not switching between the on-premises SIEM and the Entra ID portal to piece together a logon timeline. Every data point relevant to evaluating a sign-in is captured: user, application, source IP, geo-location, device, MFA outcome, and Conditional Access policy result.

• Logon Activity for Entra ID reports all cloud sign-in events with MFA status and Conditional Access outcome per event.
• Legacy Authentication sign-ins are reported separately, because these protocols bypass MFA and represent exposure in hybrid environments.
• Hybrid Logon Activity correlates sign-in events for users with both on-premises AD and Entra ID accounts, giving a single view across both directories.
• Risk detection reports surface sign-ins flagged by Entra ID Identity Protection, including impossible travel, anonymized IP, and leaked credential events.

 

 

Get a comprehensive view of logon activity across your AD and Entra ID environments.

Get real-time alerts on logon events

Knowing about a suspicious logon event an hour after it happened limits your ability to respond. ADAudit Plus sends alerts the moment a defined logon condition is met, so your team can act while the event is still containable.

• When a disabled account attempts to log on, your team is notified immediately so the attempt is logged and investigated.
• When a logon event occurs outside a user's normal hours, the UBA-driven Unusual Logon Activity Time alert notifies the responsible team so after-hours access is reviewed rather than overlooked.
• When a logon alert fires, ADAudit Plus can automatically create a ticket in ServiceNow, Jira, or your connected ITSM tool and notify the responsible team by email or SMS, so no alert sits unacknowledged in a queue.

Meet compliance requirements with logon audit reports

Logon auditing is a control requirement under every major compliance framework. SOX Section 404 requires evidence of authorized and unauthorized access to financial systems. HIPAA requires audit controls for systems that process electronic protected health information. PCI-DSS requires logging and monitoring of all access to cardholder data environments, and GDPR requires records of who accessed personal data and when. ADAudit Plus ships with pre-configured compliance report sets for SOX, HIPAA, PCI-DSS, GDPR, FISMA, GLBA, and ISO 27001.

• Compliance reports are available immediately after deployment, no custom query writing or log parsing required.
• Custom report profiles let you combine specific users, logon event types, date ranges, and source machines into saved views for recurring compliance reviews or audit requests.
• Reports export in CSV, PDF, HTML, and XLSX formats and can be scheduled for automatic email delivery to auditors, compliance officers, or external reviewers.
• Response automation means that when a logon-related alert fires, the event is not just logged but escalated through your existing ticketing workflow automatically.

Why native tools fall short for logon auditing

Windows generates logon events at the DC level, but stores Security event logs locally on each DC. An environment with four DCs has four separate log sources. Tracing a single user's logon history across the domain means logging into each DC individually, searching Event Viewer, and stitching the results together manually.

• PowerShell can automate parts of this, but it still queries each DC in sequence, requires scripting expertise to maintain, and produces output that is difficult to share with auditors or compliance teams.
• Security event logs on each DC are finite in size and overwrite when full, meaning logon history for an incident that happened weeks ago may no longer exist on the DC that recorded it.
• Event Viewer has no built-in correlation across DCs, so identifying whether the same IP address attempted to authenticate against multiple DCs requires manual cross-referencing.
• Neither Event Viewer nor PowerShell identifies the root cause of account lockouts. They record that a lockout occurred but not which application, device, or scheduled task triggered it.
• No native tool correlates on-premises AD logon events with Entra ID sign-in data in a single view.

ADAudit Plus resolves each of these gaps. Logon data from every machine is collected centrally, retained beyond the native log window, and made searchable and reportable from a single console, with lockout root cause analysis, hybrid logon correlation, and UBA-driven anomaly detection built in.