Transdev Nederland turns Active Directory auditing into auditor-accepted compliance evidence with ADAudit Plus

Business challenges

• Audit evidence for ISO and NEN certifications: External audits required the IT team to prove how Active Directory had changed over time, including security group membership changes, access to specific endpoints, and failed login counts, evidence that was difficult to assemble without a dedicated auditing tool.
• Hard-to-trace authentication failures: Failed logins caused by misconfigured automation jobs in software were time-consuming to diagnose, leading to long troubleshooting sessions on authentication issues.
• Limited visibility into out-of-pattern access: The team needed a way to spot users or service accounts reaching servers and endpoints they would not normally access, and to reconstruct a specific user's activity when an investigation called for it.

The problem

Transdev Nederland's IT infrastructure team is responsible for the security and compliance of the organisation's Active Directory environment. As a public transport operator, the company is audited against multiple standards, including ISO, NEN, and PCI DSS, and each audit requires concrete proof of how access and identity are controlled.

Producing that proof was the team's central challenge. Auditors needed to see who had been added to security groups, which endpoints had been accessed, and how many logins had failed, presented in a form they would accept. Beyond compliance, the team also faced practical operational gaps: authentication failures caused by automation jobs were hard to pinpoint and slow to resolve, and there was no easy way to identify when a user or service account was reaching systems outside its normal scope.

The solution

Transdev Nederland deployed ManageEngine ADAudit Plus to audit its Active Directory environment and to serve as the evidence base for its compliance programme. Using the product's predefined reports, the team can quickly find failed logins on endpoints, memberships added to security groups, stale user accounts, and service accounts being used out of context. The same reports allow the team to reconstruct exactly what a specific user accessed on a given day.

The failed logins section has proved to be the most valuable capability for the team's day-to-day work. By surfacing where and why authentication is failing, it exposes automation jobs that are silently breaking inside software and cuts out the lengthy troubleshooting that used to accompany authentication issues.

ADAudit Plus also supports the team's monitoring of user behaviour. When a user contacts servers or endpoints they would not normally access, the team can inspect the activity and determine whether it is legitimate. Long retention of access information means the team can investigate thoroughly whenever the need arises, confident that no user actions have been missed.

Both the sales and support teams have been quick and efficient, answering questions promptly and following up to uncover any further issues.

By giving auditors a body of evidence they accept, exposing hidden authentication failures, and retaining a complete record of user access, ADAudit Plus has become an integral part of how Transdev Nederland governs its Active Directory. The team rates its overall experience at 8 out of 10 and is highly likely to recommend the product.

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.