Scope Metals gains holistic visibility on user activity with ADManager Plus and ADAudit Plus

Business challenges

• Transparent AD change tracking: Scope needed a user-friendly way to investigate Microsoft logs, trigger alerts on anomalies, and retain logs for regulatory compliance.
• File server access reviews: With years of hierarchical folder growth, Scope lacked visibility into low-level permissions and activities.

The problem

Scope's IT administrative operations were affected by poor visibility into user and permission activity within their AD and file server environments. According to Daniel Zytner, the chief information security officer at Scope, opined that his team needed “a user-friendly interface to investigate Microsoft logs and activating alerts on irregular situations”

Furthermore, Scope's IT team identified that they needed an effective solution to perform authorization reviews of their legacy file server. Despite being in use for several years, the file server hadn't been properly audited by Scope's team, with Zytner explaining that "nobody really knew what happened in the lower folder levels." Scope's IT team was looking for solutions that helped them address their auditing and access management needs.

The solution

To solve these challenges, Scope deployed ADAudit Plus and ADManager Plus, ManageEngine's IT auditing solution and IGA solution respectively. By leveraging ADAudit Plus, Scope's IT team was able to gain real-time visibility into AD activity and file server access. “The reports are very clear and useful," said Zytner. He listed that some of the user activity reports, such as file activity, folder authorization changes, and login failures, proved to be resourceful for his team. Zytner also added that they've been scheduling the user activity-based reports, with his team specifically monitoring super users. Zytner said that "based on these reports, we perform additional activities. We also defined alerts on special situation in addition to our managed SIEM/SOC"

In tandem with ADAudit Plus, Scope's IT team implemented ADManager Plus to expand the organization's user monitoring capabilities. The IT and security teams now rely on monthly reports to audit new and deleted users, non-expiring passwords, while also supporting day-to-day operations like user creation and modification. "We are very satisfied with [ADManager Plus'] reports. Our activity is based on the reports' results," exclaimed Zytner.

Zytner opined that ADManager Plus had a “very simple implementation process and clear reports.” With Scope IT team discovering newer features by the day, Zytner was in praise of the support team. "[ManageEngine has a] very professional support team. Their chat support is excellent." Zytner expressed their satisfaction with ADAudit Plus by saying "[ADAudit Plus is a] very powerful solution. It can be used for real-time detection and alerts of our AD environment like a managed SEIM/SOC."

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.