N3i maintains audit visibility across a hybrid estate in transition with ADAudit Plus

Business challenges

• Visibility during a live migration: Mid-way through a rationalisation and cloud migration programme, consolidating servers, retiring legacy file servers, and expanding Azure use, the team needed auditing that stayed reliable while the estate underneath it kept changing.
• A large estate for a lean team: Five domain controllers, 215 member servers, and tens of thousands of directory objects had to be monitored by a handful of engineers, leaving no room for manual log review.
• Detecting attacks on privileged identity: The team wanted early warning of the specific indicators that precede a serious Active Directory compromise, such as unexpected additions to privileged groups, rather than discovering them after the fact.

The problem

N3i's environment is at an inflection point. The organisation is consolidating its server estate, retiring legacy file servers in favour of SharePoint and Azure File Shares, and expanding Azure beyond its original role as a licensing platform for Microsoft Office. At the same time, the merger of CHCP's IT function into N3i's has brought additional servers and domains into scope. Against that backdrop, a small engineering team needs dependable, scalable visibility across Active Directory, member servers, file infrastructure, and an increasingly hybrid cloud environment.

That visibility has to serve two purposes at once: the operational need to trace authentication failures and file activity across a large estate, and the security need to detect the subtle changes to privileged groups and Kerberos infrastructure that signal an attack in progress, without a dedicated security operations function to watch for them.

The solution

ADAudit Plus has been in N3i's environment as part of its existing ManageEngine investment, and it now forms the foundation of the organisation's identity auditing capability. Rather than run separate instances for N3i and CHCP, the team is consolidating into a single ADAudit Plus deployment, onboarding CHCP's servers and domains so that cross-entity audit visibility lives in one place. A Customer Success health check and utilisation review in July 2026 gave the team a structured baseline for that work.

• File server auditing: ADAudit Plus agents are deployed across all of N3i's active Windows file servers, with object-level auditing configured, audit policies in place, and File Integrity Monitoring enabled. File Analysis has been enabled for a subset of servers, with coverage extending as the file estate consolidates. As the organisation moves to Azure File Shares and SharePoint, the team is also looking at redirecting Windows file server licences to Azure File Share auditing within the product, so that visibility follows the data into the cloud.
• Active Directory change reporting and custom reports: N3i runs scheduled reports out of ADAudit Plus, including custom reports that target AdminSDHolder membership changes. These detect any account being added to privileged groups that touch the Kerberos authentication chain, and the team uses them proactively, alongside a scheduled database scan, to monitor for indicators of attack such as golden ticket creation attempts.
• Alert profiles and threat detection: Alert profiles are validated and operational, and the Attack Surface Analyzer's predefined threat profiles give the team coverage of patterns such as brute-force password attacks and lateral movement.
• Logon and authentication auditing: Logon and authentication reporting is in active use, with the team using ADAudit Plus to investigate authentication failures and trace logon activity across domain controllers and member servers.

ADAudit Plus gives N3i operational visibility across its file servers, domain controllers, and member server estate, with active alerting, scheduled reporting, File Integrity Monitoring, and targeted detection of privileged-group changes all in place. As CHCP's servers and domains are brought into the deployment, that visibility will extend across both entities from a single console, keeping a lean team in control of an estate that is changing underneath it.

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.