MCS gains a clear audit trail of file access and Active Directory changes with ADAudit Plus

Business challenges

• Limited visibility into user activity: The team had little insight into what users were doing across the domain controllers and file servers, making it difficult to quickly identify who was accessing, modifying, moving, or deleting files.
• Slow turnaround on client data-access queries: When a client asked who within MCS had accessed their data, the team had no ready mechanism to pull that information together, putting timely reporting at risk.
• No definitive record of Active Directory changes: Without an audit trail showing who changed what and when, it was hard to establish accountability when a change was disputed or denied.

The problem

MCS operates an Active Directory environment with domain controllers and file servers that store data belonging to its clients. Those clients periodically ask the organisation to confirm who has accessed their data, and the IT team is responsible for answering those requests with confidence and speed.

Before implementing ADAudit Plus, the team had limited visibility into user activity across both the domain controllers and the file servers. Identifying which users had accessed, modified, moved, or deleted a given file was difficult to do quickly, and the team was not in a position to produce the reports clients expected in a timely fashion.

The same gap affected day-to-day operations. With no clear record of changes made in the environment, disputes about who had altered a setting or object could not be settled with evidence.

The solution

MCS adopted ManageEngine ADAudit Plus to bring auditing of Active Directory and file server activity into a single platform. For Active Directory changes, the product provides a clear audit trail showing who made each change, when it happened, and what was modified. Beyond improving auditability, this has strengthened accountability within the team, since any disputed change can now be traced to its source.

Reporting is central to how the team uses the product. ADAudit Plus's reports make it straightforward to identify who made a change or accessed a file, and MCS uses them to respond to client queries directly, giving customers confidence that the organisation knows exactly who has accessed their data. On the user monitoring side, the platform flags users logging on to devices other than their usual ones and highlights accounts that are repeatedly entering the wrong password. The team uses this to proactively reset passwords that users are struggling with, while also confirming that the credentials have not been compromised.

Support has also been part of the experience. When the team encountered an issue with the PostgreSQL database, the ManageEngine support team assisted with the upgrade of the ADAudit Plus application, providing that help outside normal UK working hours.

By centralising Active Directory change auditing, file access tracking, and user monitoring in one platform, MCS can now answer client data-access questions with evidence rather than investigation, and rates its overall experience with ADAudit Plus at 8 out of 10.

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.