Privileges

Agentless privileges for Windows Server auditing

The privileges in this section apply when ADAudit Plus uses the Domain Data Collection Account for agentless Windows Server auditing, Security log access, remote status checks, or automatic audit policy configuration.

This section documents the privileges required on Windows member servers (non-DC, non-File Server) for agentless audit data collection.

Account used: ADAudit Plus authenticates to member servers using either:

• Service Account: The Service Account (process identity) should be used if it's a domain user/gMSA with the required privileges ( this is the simplest for single-domain setup).
• Data Collection Account: A Data Collection Account is required when the Service Account is Local System or for needed for additional domains. Configure this account type by going to the Admin page, then Domain Settings.

This is the same identity used for AD/GPO, File Server, and Endpoint auditing within the same domain.

Privilege summary

#	Privilege	Required	Purpose
1	Manage Auditing and Security Log	✅	Read Security event log
2	Membership in Event Log Readers Group	✅	Read Security and System logs
3	GPO Create Permissions	⚠️ Optional	Only for Automatic Audit Policy Configuration
4	Remote WMI/DCOM/RPC Access	⚠️ Optional	Only for checking audit policy status from the UI

Note: For Domain Admin accounts, all the above privileges are already granted by default. The individual privileges below are required only when configuring a least-privilege data Collection Account.

Manage Auditing and Security Log

Purpose: Required for reading the Security event log on Windows member servers.

Location: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Manage auditing and security log

Can be assigned via a GPO targeting member servers or locally on each server.

Privilege behavior:

• Grants the ability to read the security event log on member servers.
• Domain Admins have this privilege by default.
• Least-privilege accounts must be explicitly assigned this right.

Membership in Event Log Readers Group

Purpose: Required for reading Windows event logs (Security, System) on member servers to audit logon events, process tracking, service changes, and system activities.

Location: Assign via GPO or directly on each server:

• GPO: Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups > Add to local Event Log Readers group
• Local: Computer Management > Local Users and Groups > Groups > Event Log Readers
• Default access behavior: Member servers do not automatically add domain users to the local Event Log Readers group; explicit membership is required.

GPO Create permissions (Optional)

Note: This privilege is required only when Automatic Audit Policy Configuration is enabled. If you configure audit policies manually, skip this section.

Purpose: When enabled, ADAudit Plus uses the same GPO and security group as File Server auditing:

• GPO name: <DomainName>_ADAuditPlusPolicy
• Security group: ADAuditPlusFS (Domain Local, in CN=Users)

GPO permissions

• Create GPO (via Group Policy Creator Owners or delegated rights)
• Edit settings on the <DomainName>_ADAuditPlusPolicy GPO
• Link GPO at domain level

AD Security Group permissions

• Write Members on the ADAuditPlusFS group (to add/remove member server computer accounts)
• If the group doesn't exist yet: Create Group objects in CN=Users

How targeting works

Member server computer accounts are added to the ADAuditPlusFS group alongside File Server accounts. The GPO's Security Filtering ensures it applies only to machines in the group.

Note: This is the same GPO and group used for File Server auditing. ADAudit Plus does not create separate GPOs for member servers.

Remote WMI/DCOM/RPC access (Optional)

Note: This privilege is required only when you want to check the audit policy configuration status of member servers from the ADAudit Plus UI. It is not required for audit data collection itself.

Purpose: Required for querying audit policy status and system configuration from member servers via the ADAudit Plus web console.

Where to apply: These permissions must be configured on each member server that you want to check audit policy status for from the ADAudit Plus UI.

Component	Required Rights
WMI (CIMV2, RSOP\Computer)	Execute Methods, Enable Account, Remote Enable
DCOM (COM Security)	Local Launch, Remote Launch, Local Activation, Remote Activation
RPC	No separate configuration (used automatically by Windows)

For WMI namespace security, use go to WMI Control > Properties > Security.

For DCOM launch and activation settings, go to Component Services > Computers > My Computer > Properties > COM Security.