Prerequisites

Important Complete all prerequisite checks before deploying the agent. Missing prerequisites are the most common cause of installation failures.

Requirements Summary

Supported Endpoint Environments

The ADAudit Plus agent can be installed on:

Supported Operating Systems

Client Operating Systems

• Windows Vista
• Windows 7
• Windows 8 / 8.1
• Windows 10
• Windows 11

Server Operating Systems

• Windows Server 2008 / 2008 R2
• Windows Server 2012 / 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022

Note Both 32-bit and 64-bit architectures are supported where applicable.

Disk Space & EventData Directory

How EventData works:

• When the agent cannot forward data to the ADAudit Plus server (network disruption, server downtime), events are cached locally in the EventData directory.
• When connectivity is restored, cached events are forwarded to the server.
• Increasing the EventData size allows the agent to hold data longer during outages, preventing data loss if older security logs are overwritten on the endpoint.

Important When the EventData directory reaches its size limit, the agent stops collecting new data but continues running and attempting to send cached data to the server. Once data is forwarded and space is freed, collection resumes automatically.

To configure EventData directory size:

1. Log in to the ADAudit Plus web console.
2. Navigate to Admin → Agent Settings → Event Data Settings → Maximum Size of EventData Directory.
3. Enter the desired size and click Save.

Note If increasing beyond 2 GB, ensure the total disk space accommodates both the agent installation and the EventData directory. Example: 2 GB (agent) + 5 GB (EventData) = 7 GB total.

.NET Framework

The ADAudit Plus agent requires .NET Framework 4.8 or higher.

Download: .NET Framework

To verify the installed .NET Framework version:

4. On the target machine, navigate to %windir%\Microsoft.NET\Framework.
5. Look for folders starting with v4.0 or higher.

Note The agent will not function correctly if the required .NET Framework version is missing.

Antivirus Exclusions

To ensure uninterrupted agent operation, add the following exclusions to your antivirus/endpoint protection software:

Directories

Executables

Ports

Note Failure to exclude these directories, executables, or ports may result in delayed event collection, blocked communication, or failed agent installation.

Network & Firewall

Scenario 1: Direct Connection (No NAT)

Agent ──── HTTPS (8555) ────→ ADAudit Plus Server

Scenario 2: With Public Endpoint (Reverse Proxy / Load Balancer / Application Gateway / NAT)

Agent ──── HTTPS (public endpoint port) ────→ Public Endpoint ──── 8555/8444 ────→ ADAudit Plus Server

Important When a Public Endpoint is configured, agents must connect using the public endpoint FQDN and port — not the internal ADAudit Plus server hostname or IP.

Server-to-Agent Ports (RPC — optional)

Required only if managing agents directly from the ADAudit Plus console:

Note No inbound rules are required on agent machines for HTTPS-only deployments.

Time Synchronization

Ensure all endpoints and the ADAudit Plus server have accurate and synchronized time. Correct time is critical for:

• Proper auditing and event timestamping
• Correlating logs across systems
• Agent-server authentication

Tip Use NTP or domain controller time synchronization.

Public Endpoint Configuration (Cloud-Hosted)

Navigation: Admin → Network & Communication Settings → Public Endpoint

In cloud-hosted deployments where the ADAudit Plus server resides in a private subnet, agents cannot reach the server directly. A public-facing endpoint (reverse proxy, load balancer, application gateway, or NAT) must be placed in front of the server. This page tells ADAudit Plus — and all deployed agents — what that public endpoint address is.

The page shows two sections:

Internal Server Endpoint (read-only)

This is the server's own address on the internal network. Agents connecting directly (without a public endpoint) use this.

Public Endpoint (configurable)

Configure this field with the public FQDN and port of your gateway. All agents automatically adopt these settings.

*Configure the public endpoint used by ADAudit Plus agents. This endpoint may be exposed through NAT, Reverse Proxy, Application Gateway, Load Balancer, or other secure gateway technologies.*

When to configure: Required for any cloud-hosted deployment where agents connect through a public-facing gateway. Not required for on-premises deployments where agents can reach the server directly.

Effect: Once saved, agents automatically use the public FQDN and port for their connection. No per-agent reconfiguration is needed.

Supported Public Endpoint Technologies

Any technology that can receive inbound HTTPS traffic and forward it to the ADAudit Plus server on port 8555 is supported.