Uganda National Roads Authority gains enhanced AD security and audit efficiency with ADAudit Plus

Business challenges

• Limited AD visibility: UNRA struggled to keep track of critical security events, such as account lockouts and group policy changes.
• File server auditing gaps: Retrieving detailed audit information and logs from file servers was challenging, limiting insights into user activity and file access.
• Resource constraints: The need for an effective, budget-friendly solution to meet these requirements made selecting the right tool crucial for the UNRA team.

The Problem

As the Uganda National Roads Authority (UNRA) expanded its operations and implemented Active Directory (AD) for IT infrastructure management, the ICT team encountered numerous security and visibility challenges. "We had a couple of challenges," John Kihumuro, the ICT officer from UNRA noted. Key issues included the difficulty of tracing account lockouts, retrieving file server audit information, and lacking visibility into domain controller activity. Without a dedicated AD auditing solution, it was challenging to ensure compliance and security across the AD environment.

Further complicating matters, UNRA had limited options for monitoring AD-related security events. According to the Kihumuro, "We were not able to see proper audit logs of Administrator privilege usage or monitor group policy changes." This lack of transparency made it difficult for the team to track who had administrative privileges or if any unauthorized access attempts were taking place. Additionally, as a government entity, UNRA had to ensure their IT environment complied with regulatory standards, and having limited insights into AD events put this at risk.

Another critical gap involved the lack of sufficient logs from member servers, which limited the organization’s ability to assess security threats or audit activity. Retrieving these logs was a time-consuming process, requiring the team to sift through data manually to detect suspicious behavior.

The Solution

UNRA turned to ADAudit Plus to address these pressing challenges, finding in the tool a reliable, feature-rich, and affordable solution. ADAudit Plus provided the visibility UNRA had been missing, enabling the ICT team to easily monitor critical AD changes and receive real-time alerts. "We are able to track AD object creation and deletion, critical changes like group policy modifications, and AD security-related events," the Kihumuro shared, emphasizing how ADAudit Plus had significantly enhanced their ability to stay on top of essential AD activity.

With ADAudit Plus' reporting capabilities, UNRA now receives clear, concise reports on essential security events, such as user logins, password changes, and account lockouts. These reports have simplified compliance tracking and security auditing. "ADAudit Plus' reports help us monitor logins by providing [the user's] IP address to identify suspicious activities. Reports on password changes are also helpful in this regard," noted the Kihumuro, reflecting on the improved level of security the solution has provided.

ADAudit Plus’ user monitoring capabilities were especially beneficial for tracking user behavior across various endpoints. Kihumuro mentioned that "[ADAudit Plus'] First and last logon [reports] is very helpful in monitoring user logins. Yes, file and folder changes are well tracked for our file servers," highlighting the enhanced control the team now has over user activities.

In summary, ADAudit Plus transformed UNRA’s AD auditing approach, providing the visibility, compliance support, and security insights necessary to manage their environment effectively. "ADAudit Plus is effective and affordable," the Kihumuro summarized, adding, "Lots of online material were available for us to operate and learn about ADAudit Plus," attesting to the solution's value as an AD auditing tool for a public sector organization like UNRA.

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.