Troubleshooting

Domain Controllers are not listed after installation

Symptom: ADAudit Plus does not show the expected local domain or domain controllers after installation.

Resolution:

• Confirm that the ADAudit Plus server is domain-joined or can resolve the target domain.
• Add the domain manually using Domain Settings > Add Domain.
• Confirm the specified domain controller is online and reachable.
• Confirm the domain data collection identity is configured correctly.

No Active Directory audit events appear in reports

Symptom: The domain is configured, but Active Directory audit reports show no data.

Resolution:

• Confirm required audit policies are configured using Configure audit policies.
• Confirm object-level auditing is configured using Configure object-level auditing (SACL).
• Verify that Windows events are generated on the domain controller using Event Viewer.
• Confirm the domain data collection identity has the required privileges in Agentless privileges for Active Directory and GPO auditing.
• Confirm the Security event log is not overwriting events too quickly.

GPO history or GPO change reports are incomplete

Symptom: GPO changes are performed, but ADAudit Plus does not show complete GPO history.

Resolution:

• Confirm audit policy settings for DS Access and Policy Change are enabled.
• Confirm the GPO-related SACL entries in SACL entries for OU, GPO, user, group, computer, and contact objects are configured.
• Confirm object-level auditing was configured through the GPO History prompt or manually.
• Confirm the domain data collection identity has read access to SYSVOL.

DNS change auditing is incomplete

Symptom: Active-Directory-integrated DNS changes are not reflected in ADAudit Plus reports.

Resolution:

• Identify where the DNS zone is stored: domain partition, DomainDNSZones, or ForestDNSZones.
• Configure the DNS SACL entries in SACL entries for DNS objects for the relevant partitions.
• Confirm the domain data collection identity has read access to DNS-related naming contexts.

Audit policy changes are not taking effect

Symptom: Configured audit policy settings do not appear to apply to domain controllers.

Resolution:

• Use Group Policy results as described in Verify audit policies and event log settings.
• Confirm Audit: Force audit policy subcategory settings is enabled when using advanced audit policies.
• Confirm the target domain controller receives the Default Domain Controllers Policy or the intended equivalent GPO.
• Allow Group Policy replication and refresh to complete.

Events are overwritten before ADAudit Plus collects them

Symptom: Reports show gaps during high-volume periods or after the ADAudit Plus server was unavailable.

Resolution:

• Increase the Security log size beyond the minimum values in Recommended Security log size.
• Ensure Retention method for security log is set to Overwrite events as needed.
• Validate that the Security event log holds at least 12 hours of data.
• Review domain controller event volume and adjust log size based on actual load.

Frequently asked questions

Q1: Why is object-level auditing required if audit policies are already configured?

Audit policies enable Windows to log broad categories of activity. Object-level auditing (SACL) defines which specific Active Directory objects and operations generate events. Both are required for complete Active Directory object change auditing.

Q2: Should I use automatic or manual configuration?

Use automatic configuration when you want ADAudit Plus to configure required audit policies or object-level auditing with your consent. Use manual configuration when your organization requires change control, GPO review, or security team approval before applying audit settings.

Q3: Does automatic audit policy configuration happen without approval?

No. ADAudit Plus does not configure audit policies or object-level auditing automatically without user consent.

Q4: Where are account and privilege requirements documented?

Use Accounts & Privileges Overview for account concepts and Agentless privileges for Active Directory and GPO auditing for least-privilege requirements.

Q5: Why does the guide include legacy audit policies?

This guide includes legacy audit policy guidance for older environments where advanced audit policies are not available. Windows Server 2003 / 2003 R2 has reached EOL from Microsoft; this content is retained only for legacy reference. Advanced audit policy guidance is recommended for currently supported deployments.

Q6: Why must the Security log hold at least 12 hours of data?

If events are overwritten before ADAudit Plus collects them, the lost events cannot be recovered from the domain controller. Configure the Security log to hold at least 12-24 hours of data, and increase the log size beyond the baseline recommendation when event volume is high.

Q7: Which event can I use to verify audit collection?

You can verify any valid event captured by ADAudit Plus for the configured audit category. Event ID 4768 is a useful example for Kerberos Authentication Service success auditing because it is logged for each Active Directory logon request.

Q8: Do I need to configure every domain controller?

Yes. Events are generated on the domain controller that processes the operation. Configure audit policies, object-level auditing, event log settings, and ADAudit Plus collection for all relevant domain controllers.