Privileges

Agentless privileges for workstation and endpoint auditing

The privileges in this section apply when ADAudit Plus uses the Domain Data Collection Account for agentless workstation auditing, remote status checks, audit policy verification, or automatic audit policy configuration.

This section documents the privileges required on Windows endpoints (workstations) for agentless audit data collection.

Account used: ADAudit Plus authenticates to endpoints using either:

• The Service Account (process identity)—if it's a domain user/gMSA with the required privileges (simplest single-domain setup).
• A Data Collection Account configured in Admin > Domain Settings—required when the Service Account is Local System or for additional domains.

This is the same identity used for AD/GPO, File Server, and Windows Server auditing within the same domain.

Note: For endpoints that use the ADAudit Plus agent, audit data is collected locally by the agent using separate privileges.

Privilege summary

	Privilege	Required	Purpose
1	Manage Auditing and Security Log	✅	Read security event log
2	Membership in Event Log Readers Group	✅	Read security and system logs
3	GPO Create Permissions	⚠️ Optional	Only for automatic audit policy configuration
4	Remote WMI/DCOM/RPC Access	⚠️ Optional	Only for checking audit policy status from the UI

Note: For Domain Admin accounts, all the above privileges are already granted by default. The individual privileges below are required only when configuring a least-privilege Domain Data Collection Account.

Manage auditing and security logs

Purpose: Required for reading the security event log on Windows endpoints.

Location: Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Manage auditing and security log.

Reading rights can also be assigned via a GPO targeting endpoints or locally on each endpoint.

Privilege behavior:

• Grants the ability to read the security event log on endpoints.
• Domain Admins have this privilege by default.
• Least-privilege accounts must be explicitly assigned this right.

Membership in Event Log Readers Group

Purpose: Required for reading Windows event logs (security, system) on endpoints to audit logon/logoff events, USB activity, process tracking, and endpoint security events.

Location: Assign via GPO or directly on each endpoint:

• GPO: Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups > add the service account to the local Event Log Readers group.
• Local: Computer Management > Local Users and Groups > Groups > Event Log Readers.

Default access behavior: Endpoints do not automatically add domain users to the local Event Log Readers group; explicit membership is required.

Note: For large endpoint environments, GPO-based assignment is strongly recommended over per-machine configuration.

GPO Create Permissions (Optional)

Important: This privilege is required only when Automatic Audit Policy Configuration is enabled. If you configure audit policies manually, skip this section.

Purpose: When enabled, ADAudit Plus:

• Creates a GPO named <DomainName>_ADAuditPlusWSPolicy.
• Creates a Domain Local Security group ADAuditPlusWS in CN=Users.

Note: The endpoint GPO uses the WSPolicy suffix (for "workstation") to distinguish it from the ADAuditPlusPolicy GPO used for file servers and member servers.

GPO Permissions

Location: Group Policy Management Console > {Domain Name} > Group Policy Objects

1. Create GPO (via Group Policy Creator Owners or delegated rights).
2. Edit settings on the <DomainName>_ADAuditPlusWSPolicy GPO.
3. Link the GPO at domain level.

AD Security Group Permissions

Location: CN=Users container in Active Directory.

• Create group objects (to create ADAuditPlusWS).
• Write members (to add/remove workstation computer accounts).

How targeting works

The GPO is linked at the domain level. Security Filtering via the ADAuditPlusWS group ensures it applies only to monitored workstations. Computer accounts are added/removed from the group as endpoints are added/removed from auditing.

Note: ADAudit Plus creates a separate, dedicated GPO for endpoint audit policies. It does not share the File Server/member server GPO.

Remote WMI/DCOM/RPC Access (Optional)

Important: This privilege is required only when you want to check the audit policy configuration status of endpoints from the ADAudit Plus UI. It is not required for audit data collection itself.

Purpose: Required for querying audit policy status and system configuration from endpoints via the ADAudit Plus web console.

Where to apply: These permissions must be configured on each endpoint that you want to check audit policy status for from the ADAudit Plus UI.

Component	Required rights
WMI (CIMV2, RSOP\Computer)	Execute Methods, Enable Account, Remote Enable
DCOM (COM Security)	Local Launch, Remote Launch, Local Activation, Remote Activation
RPC	No separate configuration (used automatically by Windows)

For WMI namespace security, go to WMI Control > Properties > Security. For DCOM launch and activation settings, go to Component Services > Computers > My Computer > Properties > COM Security.