Overview

    Purpose of Agent Installation

    The ADAudit Plus agent is a lightweight Windows service that collects audit data from domain controllers, servers, and workstations. Installing the agent ensures:

    • Centralized auditing — consolidates audit data from multiple endpoints into the ADAudit Plus server
    • Minimal user intervention — runs in the background with minimal maintenance once deployed
    • Reliable data collection — ensures consistent audit data capture even in complex or geographically distributed environments

    Note This guide covers the Windows agent only. The macOS agent is covered in a separate document.

    Benefits

    Benefit Description
    Real-time data collection Captures logon events, user activities, and AD changes immediately as they occur
    Improved accuracy Minimizes missed events compared to remote, agentless polling methods
    VDI & cloud support Works with virtual desktops, VMs, cloud-hosted endpoints, and geographically distributed machines
    Optimized network usage Reduces bandwidth utilization through efficient, batched data transfer
    Lightweight Minimal CPU, RAM, and disk usage (see details)
    Server load reduction Collects and parses audit data locally, reducing processing overhead on the ADAudit Plus server
    No admin privileges needed on endpoints The ADAudit Plus server does not need administrative privileges on endpoints
    No RPC ports needed for data collection Agent pushes data to the server over HTTPS — no inbound RPC ports required on endpoints
    Encrypted communication All agent-to-server communication is over HTTPS
    Scalability Handles hundreds or thousands of endpoints efficiently
    Offline resilience Temporarily stores audit data locally (EventData directory) and synchronizes when connectivity is restored

    Resource Usage

    Resource Typical Usage
    CPU 1-2%
    RAM 65-75 MB
    Disk (agent installation) ~2 GB
    Disk (EventData cache) 2 GB default (configurable up to 10 GB)
    Network HTTPS on port 8555 (configurable)