Ballard Power Systems improves AD security and reduces account lockouts with ADAudit Plus

Business challenges

• Frequent account lockouts: Ballard experienced recurring client lockout events, creating daily operational disruptions and placing a burden on IT support.
• Enhanced data loss prevention (DLP): The organization aimed to improve security monitoring and prevent data loss through better visibility into Active Directory changes.
• Detecting anomalous account behavior: The organization encountered a need to identify and respond to irregular activities from user and service accounts to bolster system security.

The problem

Prior to implementing ManageEngine ADAudit Plus, Ballard faced two major challenges: ensuring data security and insufficient insight into user activities affecting security and compliance. “DLP and security were the primary motivation for acquiring this product, along with frequent client lock out events that were the day to day operational benefit,” explained William Purves, Principal IT Architect at Ballard. The IT team lacked an effective mechanism to trace these incidents back to their source and needed a solution that could deliver both operational efficiency and stronger auditing capabilities.

The solution

ADAudit Plus, ManageEngine's IT auditing solution, provided immediate value by enabling Ballard to trace the root causes of account lockout events using real-time auditing and event correlation features. “So far it has been an immense help in running down the root causes of account lockout events, and occasionally assisted with diagnosing unusual client behavior,” said Purves. The software's ability to track logon failures, correlate them with account lockouts, and alert the team in real time allowed for faster resolution and reduced user downtime.

The solution reporting functionality also stood out. “[ADAudit Plus' reports are[ highly effective, very clear and concise - easy to implement and customize to our requirements; typically, they just work out of the box,” noted Purves. ADAudit Plus offers over 200 preconfigured reports that cover everything from user logons to AD changes and file access. Besides that, ADAudit Plus' custom reporting feature enabled organizations such as Ballard to fetch tailored insights that met their unique needs.

ADAudit Plus user monitoring and alerting capabilities further enhanced their security posture. Purves also added that ADAudit Plus was “very effective in resolving the primary requirement of account lockouts and good for alerting on strange user or service account behaviors.”

ADAudit Plus' ML-coded user behavior analytics (UBA) module helped Ballard uncover hidden risks. “It helped to identify several service accounts that were performing unusual activities in our environment,” shared Purves. By establishing a baseline of normal user and service account behavior, ADAudit Plus makes it easier for security teams to detect deviations that could indicate account compromise or misuse.

The support services offered by ManageEngine’s team was another highlight. Purves expressed that the support was “Fantastic." adding that "they are friendly and knowledgeable of the product and always ready to help,” Purves commented. Reflecting on ADAudit Plus as a whole, he concluded, “It's an ideal product and we're looking forward to exploring the Entra ID capabilities that it has as well as end user devices.”

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.