ADAudit Plus delivers AD change management and user monitoring for Baker Ross

Business challenges

• AD change management: Baker Ross found difficulty tracking changes in Group Policy Objects (GPOs) and Organizational Units (OUs). Furthermore, the organization lacked visibility into file deletions.
• User activity tracking: Lack of insight into failed login attempts, especially for admin accounts, proved to be a challenge for the organization.

The problem

Baker Ross Ltd faced significant challenges in monitoring and managing their Active Directory environment. They struggled with gaining visibility into changes made to GPOs and OUs, tracking failed login attempts, particularly for administrative accounts, and detecting mass file deletions. These issues posed security risks and operational inefficiencies. Richard Scorey, the IT operations manager from Baker Ross, mentioned that his team "needed better visibility of changes made to GPO's, OU's as well as failed logins, particularly for admin accounts. We also wanted better visibility of mass file deletions."

The solution

Implementing ADAudit Plus transformed Baker Ross Ltd's Active Directory management and security posture. The solution provided comprehensive tracking and alerting capabilities for AD changes, including email alerts for security threats like disabled account login attempts. The scheduled reports offered a consolidated view of log information, enhancing the organization's ability to monitor and analyze activities. Richard Scorey highlighted, "We setup email alerts to notify us of changes we are interested in and could be a security threat. Items such as Disabled account attempted login." ADAudit Plus' user monitoring features, such as alerts for account lockouts and failed logins, significantly improved the company's security measures.

ADAudit Plus' User Behavior Analytics (UBA) feature helped the organization's IT team identify frequently locked out users and those logging into multiple workstations. Heaping praises on the technical support received for ADAudit Plus, Scorey recounted how the support team played a crucial role in setting up SQL auditing, which further extended ADAudit Plus' capabilities. Scorey summarized his ADAudit Plus experience by expressing how the solution helped them achieve a micro and macro-level visibility of his organization's IT ecosystem, adding that "[ADAudit Plus] made us more aware of what is happening within our AD environment, both at a user level as well as at a file and folder level."

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.