Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for Windows Server auditing. In this guide, Windows Servers refers to domain-joined Windows member servers that are not domain controllers (DCs).

Follow this setup workflow before relying on Windows Server audit reports for audit, investigation, compliance, or user behavior analytics:

• Configure Windows Servers in ADAudit Plus.
• Configure the required audit policies on monitored Windows Servers.
• Configure Security event log retention and size.
• Verify that expected Windows events are generated and collected.
• Review dashboards, reports, and alerts for server activity.

What ADAudit Plus audits on Windows Servers

ADAudit Plus helps audit and report on activity across monitored Windows member servers, including:

• Local logon and logoff activity.
• Local user and group account management.
• Process creation and termination.
• Scheduled task changes.
• Service and system activity.
• Printer activity.
• Removable storage activity.
• Active Directory Federation Services (AD FS), Active Directory Lightweight Directory Services (AD LDS), and Local Administrator Password Solution (Windows LAPS)-related activity where these components are deployed.
• File integrity activity where applicable and configured.
• High-risk or unusual server activity through alerts and user behavior analytics.

Note This guide focuses on server onboarding, audit policy configuration, event log settings, and verification. Feature-specific configuration, such as file/folder access auditing, may require the relevant dedicated guide.

Supported Windows Server versions

ADAudit Plus Windows Server auditing can be configured for supported Windows Server versions used in your environment.

Legacy reference: Windows Server 2003 / 2003 R2 has passed end-of-life support from Microsoft and should not be used for new deployments. Legacy audit policy notes are retained only for older environments.