ADAudit Plus Service Account

What is the ADAudit Plus Service Account?

The ADAudit Plus Service Account is the Windows identity under which the ADAudit Plus Windows service process runs.

Field	Details
What it is	The Windows account under which the ADAudit Plus Windows service runs
Default	Local System
Where to configure	Windows Services console (services.msc) → ManageEngine ADAudit Plus → Log On tab

Default: Local System

By default, ADAudit Plus runs as Local System. This is sufficient for most installations:

• Local System has full access to the local machine
• Data collection from remote machines is handled by the Domain Data Collection Account configured in Domain Settings — it does not depend on the Service Account
• Most customers never need to change the Service Account

When to change the Service Account

Change the Service Account from Local System to a domain user or gMSA only when the ADAudit Plus server process itself needs to access a remote network resource using Windows Integrated Authentication:

Scenario	Why the Service Account Needs Network Access
ADAudit Plus connects to a remote MSSQL database	SQL Server Windows Integrated Authentication requires the service process identity to authenticate over the network
ADAudit Plus Archive is stored on a remote file share	Writing archive files to a UNC path requires the service process to authenticate to the remote share
Scheduled report save location is a remote network share	Saving exported reports to a UNC path requires the service process to authenticate to the remote share

If none of the above apply (built-in PostgreSQL, local archives, local reports), the Service Account can remain as Local System.

Service Account as Data Collection Identity (Alternative)

In single-domain environments, if the Service Account is configured as a domain user or gMSA with the required privileges, it can also serve as the data collection identity. In this case, you do not need to configure a separate Data Collection Account in Domain Settings.

This is an alternative to the primary approach (configuring a Data Collection Account in Domain Settings). Most deployments use the primary approach and leave the Service Account as Local System.

For full details on this alternative and when it makes sense, see Alternative: Using the Service Account.

Service Account limitations

• Cannot authenticate across domain boundaries. Even when configured as a domain user/gMSA, it can only authenticate within its own domain.
• Requires service restart. Changing the Service Account requires stopping and restarting the ADAudit Plus service.