The Hong Kong Department of Health enhances AD monitoring with ADAudit Plus

Business challenges

User logon monitoring: The IT at the Hong Kong department of health team faced challenges in identifying suspicious logons, such as instances where users logged into multiple computers, Local Administrator Password Solution (LAPS) logons, etc.,

The problem

The Department of Health faced visibility and tracking issues within their large and complex IT environment. Jacky Ng, IT Administrator at the Department of Health, explained, “It was difficult to track which users were logging into multiple computers, who was using LAPS, and which admin was making changes to GPOs and user accounts.” Given the large-scale IT environment—with over 10,000 user accounts and 8,000 computer objects—the organization was looking for an IT monitoring solutions that helps its IT team gain visibility over anomalous user activities.

The solution

With the implementation of ManageEngine ADAudit Plus, the Department of Health successfully transformed its Active Directory (AD) monitoring, security visibility, and compliance reporting. The solution provided enhanced visibility into user activity, enabling the IT team to track logins across multiple devices with ease. Ng, IT Administrator at the Department of Health, emphasized the impact of this feature, stating,“ADAudit Plus allows us to quickly identify which users are logging into multiple computers, making it much easier to monitor potential security risks.”

The reporting capabilities of ADAudit Plus proved invaluable, particularly in meeting compliance requirements. The IT team had previously faced difficulties compiling user logon reports and GPO changes for audits, a process that was both time-consuming and prone to errors. With ADAudit Plus, they could now generate detailed, accurate reports in seconds. “[With ADAudit Plus,] it is faster to generate user logon reports, GPO reports, and fulfilling the company audits.” Ng noted.

The addition of User Behavior Analytics (UBA) further enhanced security, allowing the IT team to identify abnormal login behaviors and take preventive action. ADAudit Plus' user activity reports highlighted the users logging into multiple computers, helping the organization's IT department flag unusual activity.

Throughout the deployment process, ManageEngine’s support team played a crucial role in ensuring a smooth transition. Ng praised the responsiveness of the team, stating that ManageEngine's support technicians promptly delivered solutions during their journey with ADAudit Plus. Ng and his team experienced a newfound sense of ease and efficiency with ADAudit Plus, adding "[With ADAudit Plus], I can easily audit and monitor user logons, file deletions, or modification in the AD and export them for IT auditing."

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.