ADAudit Plus enhances audit trails and reduces PowerShell use at the Charlotte Regional Visitors Authority

Business challenges

• Manual Active Directory (AD) alerting: Generating AD alerts manually through custom PowerShell scripts was labor-intensive and prone to errors.
• File server auditing: Determining the cause of file deletions was challenging, leading to unresolved user complaints about missing files.
• Visibility into admin actions: Tracking the activities of junior administrators was difficult, increasing the risk of mistakes that could damage the AD infrastructure.

The Problem

Before implementing ADAudit Plus, CRVA faced significant challenges in managing their Active Directory environment. According to Jason Arnold, IT Director at CRVA, the overbearing reliance on writing custom PowerShell scripts to generate alerts on newly onboarded and offboarded users turned out to be a cumbersome effort. Besides, the organization also needed a robust file server auditing solution to address user complaints about missing files. "We needed a solution to provide solid answers when users claimed, 'my files just disappeared,' and we knew the user had accidentally deleted them," added Arnold. Additionally, oversight of junior administrators was inadequate, with no mechanism to track their activities or ensure they were not making unauthorized changes.

The Solution

CRVA adopted ADAudit Plus to enhance their AD auditing capabilities. The solution automated the generation of AD alerts, eliminating the need for custom PowerShell scripts. This automation significantly reduced manual effort and errors. "One benefit is tracking activity when junior administrators are added to our team. We track their activity to include after-hours logons, reading LAPS passwords, resetting passwords, etc.," Arnold mentioned. ADAudit Plus also helped CRVA establish a granular audit trail of file-based user actions, allowing CRVA to quickly identify who deleted files and when. "Previously, users would report files missing from a network folder and we had no way of determining what happened. With ADAudit Plus, we can run a quick search and determine who deleted the files with an exact time and date," Arnold explained.

The weekly and monthly reports on AD activities and Azure Risky User Logins furnished by ADAudit Plus further enhanced their monitoring capabilities, ensuring any inappropriate changes were swiftly identified and addressed. Arnold also expressed that he was "completely impressed" with the technical support provided by ManageEngine, adding "I always get a prompt response and they have solved every ticket I've opened. The individuals I've encountered are professional and knowledgeable with the product. I've often bragged about ManageEngine's support to my peers."

Since its deployment, ADAudit Plus has become an irreplaceable component in CRVA's IT infrastructure, with Arnold summarizing "I literally can't imagine not having ADAudit Plus in our environment. It has been an absolute game changer for us in knowing what's going on in real time and investigating events after the fact."

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.