Cauldwell Wingate traces account lockouts to their source with ADAudit Plus

Business challenges

• Untraceable account lockouts: When user accounts locked out, the IT team struggled to determine where the lockouts were coming from and when they were happening.
• No oversight of changes to Active Directory: Changes made to Active Directory by IT staff were not tracked, making it difficult to connect a later issue back to the change that caused it.
• Gaps in native Active Directory alerting: Active Directory offered no built-in way to notify the team of the events it most needed to know about, from unusual lockouts to privilege escalation attempts.

The problem

Cauldwell Wingate's network team is responsible for the health and security of the firm's Active Directory environment. Its most persistent problem before ADAudit Plus was account lockouts. Users would find themselves locked out, and the team had no straightforward way to identify the source of the lockout or the moment it occurred, which made both troubleshooting and security assessment slow.

Lockouts were one symptom of a wider visibility gap. Active Directory does not natively provide notifications for many of the events an IT team needs to watch, so changes made by IT staff went unrecorded, and there was no early warning of unusual privilege escalation attempts.

The solution

Cauldwell Wingate deployed ManageEngine ADAudit Plus as an added layer of visibility over its Active Directory. The team configured alerts that proactively notify it of locked accounts and, in particular, of unusual lockout patterns, so that lockouts are surfaced as they happen rather than discovered after the fact. When a lockout occurs, ADAudit Plus's reports show exactly where it originated, allowing the team to verify the source and take any security action that is needed.

Change auditing has closed the oversight gap. The team can now monitor every change made to Active Directory by IT staff and keep track of any issues that arise from those changes, linking cause to effect. User monitoring extends that vigilance to security: ADAudit Plus lets the team spot unusual privilege escalation attempts and act on them before they become an incident.

Support has matched the product. ManageEngine's team is responsive and knowledgeable, and proactively manages renewals so the firm never has to worry about a lapse in coverage.

With proactive lockout alerting, change tracking, and escalation monitoring in place, Cauldwell Wingate has the visibility into Active Directory that the platform alone could not provide. The team rates its overall experience with ADAudit Plus at 9 out of 10 and is highly likely to recommend it.

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.