ADAudit Plus provides Eggar's School with uncompromising visibility into cyberthreats

Business challenges

• Incident response gaps: The IT team at Eggar's School found it difficult to keep track of the security threats and anomalous events happening across their IT environment. As a result, they encountered difficulties in responding to the threats effectively.
• Limited visibility across AD: IT administrators at Eggar's School lacked the necessary tools to gain visibility over every suspicious event happening within its AD environment.

The problem

Being an educational institution, the IT team at Eggar's School faced a unique problem: deriving visibility and data-driven insights from a whirlwind of changes done across its AD environment on a daily basis. As student accounts undergo various role changes owing to promotions, departures, etc. the IT administrative teams faced with an overwhelming amount of event data. Therefore, IT admins struggled to single out anomalous events that occurred within its AD ecosystem.

Daryl Reseigh, the IT Manager at Eggar's School, observed this difficulty, noting that "[Working in a school environment] cyber security threats happen both inside the network and outside of the network, and it was hard to keep track of threats. Many audited events would go unnoticed, and as a result, no preventative action could be taken."

The Solution

To address the school's unique security needs, Reseigh's team implemented ADAudit Plus, ManageEngine's IT auditing solution. ADAudit Plus' ML-powered user behavior monitoring and reporting capabilities empowered Eggar's ' IT team with visibility and control over AD changes and user activity. With ADAudit Plus, the IT team at Eggar's School now receives instant alerts for high-impact AD changes, such as modifications done to users, groups, and Office 365 groups. Apart from ensuring fine-grained visibility, ADAudit Plus' alert profiles and prepackaged reports helped Eggar's ' IT team ensure no mistakes are made by administrators and allow the team to track potential misuse or misconfigurations.

Eggar's School's IT team found ADAudit Plus weekly reports, especially the ones on new owners and members, valuable for their daily operations. Apart from establishing an audit trail for the changes, these reports also gave Reseigh's team a much-needed change to validate the changes and rollback the erroneous ones made by his team.

Reseigh lauded ADAudit Plus' user monitoring capabilities, noting how the feature proved to be an instrumental one in addressing the school's unique IT challenges. He noted, "[The user monitoring] feature is particularly useful in a school setting. It allows IT to monitor the use of its administrator accounts, potential misuse of accounts, and accounts that may have suspicious activity."

He added "[ADAudit Plus] allows us to track users who lock out their accounts and gives my support team a heads up before the user visits the department for support. It gives huge peace of mind knowing that if someone tries to login as an administrator, we are given an instant alert and can take immediate action if necessary. It allows IT staff to build a pattern on what's happening on the network and which users might need additional support."

Besides ADAudit Plus' reporting features, the solution's ML-based User Behavior Analytics (UBA) feature further empowered the IT team to identify unusual account behavior by establishing activity baselines for every user, and take preventative action whenever required. Reseigh characterized ManageEngine's support team as "responsive, helpful and friendly" at every occasion, and noted they "were responsive, and have great knowledge of the product they are supporting."

Reseigh summarized his overall thoughts on ADAudit Plus in one word, 'brilliant', and remarked that after implementing ADAudit Plus, "everything is audited in an easy to read way and the instant notifications are extremely powerful." He added, "I can see ADAudit Plus being extremely useful in a larger environment where many IT Support staff are making changes to a single network. It allows managers to have an overview of the network and what is being performed on it. Audits are a lot easier to read than finding them yourself in Microsoft logs and event viewer."

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.