How Rio Grande Streamlined AD Lockout Tracking with ManageEngine ADAudit Plus

Business challenges

• Inefficient lockout tracking: Prior to implementing ADAudit Plus, identifying the source of Active Directory (AD) lockouts required manually sifting through event logs—an unreliable and time-consuming process.
• Lack of insight into user behavior: The IT team lacked visibility into users repeatedly entering incorrect passwords, potentially signaling poor password practices or security concerns.

The problem

Richard Carreras, the senior systems administrator at Rio Grande, recalled the inefficiencies their team faced when diagnosing AD lockouts: “We had to look through event logs to find where someone was being locked out from, and that was a painful process that most times didn’t even give a good result.” This manual approach not only consumed valuable time but also yielded inconsistent outcomes, making it difficult to support end users effectively. Rio Grande needed a more streamlined, accurate, and user-friendly way to monitor lockouts and user behavior within their AD environment.

The solution

Rio Grande deployed ADAudit Plus, ManageEngine's unified auditing solution, to address their immediate need: account lockout analysis. “We have only used it for tracking lockouts,” Carreras noted. With ADAudit Plus, Help Desk technicians were quickly able to pinpoint the source of lockouts, reducing time spent on diagnosis and improving user support efficiency. “The queries we have used are always accurate and effective for my Help Desk IT team,” he added.

The initial results gained from ADAudit Plus have prompted interest among Rio Grande's IT team in exploring more features, such as scheduled reporting and user behavior analytics. “It shows us who is constantly putting in bad passwords,” Carreras said. He said that the visibility into poor password hygiene has ignited policy-level discussions, such as the decision to implement password vaults for non-IT users.

Carreras also highlighted the responsiveness of ManageEngine's support team: “Many times, the issues were resolved in one interaction. Sometimes, we might require a license or something to implement reports. But the team always shows us workarounds using event IDs.” These experiences reinforced ADAudit Plus’ practical value and its potential to scale with their auditing needs.

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.