Privileges

Agentless privileges for Active Directory and GPO auditing

The privileges in this section apply when ADAudit Plus uses the domain data collection account for agentless Active Directory and GPO auditing on domain controllers.

This section documents the privileges required on Windows-based domain controllers for agentless audit data collection.

Account used: ADAudit Plus authenticates to domain controllers using either:

• The service account (process identity)—if it's a domain user or gMSA with the required privileges (simplest single-domain setup), OR
• A data collection account configured in Admin > Domain Settings—required when the service account is Local System or for additional domains

This is the same identity used for file server, Windows server, and endpoint auditing within the same domain. See Domain Data Collection Account for how authentication works.

Note For domain controllers that use the ADAudit Plus agent, these privileges are not required.

Privilege summary

Note For Domain Admin accounts, all the above privileges are already granted by default. The individual privileges below are required only when configuring a least-privilege data collection account.

Manage Auditing and Security logs

Purpose: This privilege is required for two critical functions during Active Directory auditing:

• Reading the Security event log on domain controllers, which contains authentication events, directory service changes, Kerberos activity, and account management operations.
• Configuring object-level auditing (SACL) on Active Directory objects and file system objects, which is essential for auditing changes and detecting unauthorized modifications.

Location: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Manage auditing and security log

Privilege behavior:

• Grants the ability to read and clear the security event log (ADAudit Plus requires only read access; it does not clear the log).
• Required to set and read SACLs (object-level auditing).
• Domain Admins have this privilege by default.
• Least-privilege accounts must be explicitly assigned this right.

Note This privilege applies specifically to domain controllers for Active Directory auditing. It can be assigned through a domain GPO or any equivalent enterprise configuration method. Without this privilege, ADAudit Plus cannot read the Security log or access required SACL configurations, resulting in incomplete Active Directory auditing.

Membership in Event Log Readers group

Purpose: Required for reading Windows event logs, such as Security, System, and Directory Service logs, on domain controllers. ADAudit Plus relies on these logs to audit authentication events, directory changes, policy updates, and system activities.

Location: Active Directory Users and Computers > {Domain Name} > Builtin > Event Log Readers

Required rights: Membership in this group grants the data collection account permission to:

• Query and read Security logs on domain controllers.
• Access Directory Service and System logs.
• Use event log APIs required for Active Directory auditing.

Default access behavior: Domain controllers do not automatically add domain users to the Event Log Readers group; explicit membership is required.

How to assign: Open Active Directory Users and Computers > expand {Domain Name} > Builtin > double-click Event Log Readers > Members tab > Add > add the data collection account.

Read access to SYSVOL

Purpose: Required for auditing GPO configuration changes. ADAudit Plus monitors the SYSVOL directory structure on domain controllers to detect modifications to GPO templates, policy files, scripts, and related configuration artifacts.

Location: The data collection account requires Read access to the SYSVOL share on all domain controllers:

\\<DomainController>\SYSVOL

This directory stores all GPO definitions, including:

• GPT.ini
• Machine and user subfolders
• Administrative template files
• Security policy templates
• Scripts associated with GPOs (if any)

Default access behavior: Standard domain users typically have read access to SYSVOL by default. If SYSVOL ACLs are restricted due to hardened baselines (CIS/STIG), the data collection account must be explicitly granted read access.

Note NETLOGON access is not required for Active Directory auditing in ADAudit Plus. ADAudit Plus uses read-only access to SYSVOL and does not modify or alter any policy files.

Read access to Active Directory objects and naming contexts

Purpose: Required for retrieving Active Directory object attributes, replication metadata, directory service changes, DNS-related Active Directory data, authentication information, and configuration data across all Active Directory partitions.

Required Active Directory naming contexts

The data collection account requires Read access on the following Active Directory naming contexts:

Security permission requirement

The data collection account must have Read permissions on each of the above naming contexts. These permissions are standard Active Directory ACL permissions and can be viewed or modified under:

Object > Properties > Security

Default access behavior

Standard domain users have read access to these naming contexts by default. No special delegation is required unless custom restrictive ACLs, CIS/STIG templates, or hardened environments limit read access.

How ADAudit Plus uses this access

ADAudit Plus uses LDAP or Global Catalog queries across these naming contexts to enumerate Active Directory objects, attributes, DNS records, replication metadata, and directory topology for accurate auditing and reporting.

Verification tools

You may use any standard Active Directory management tool to view or verify naming contexts and ACLs:

These tools do not change the privilege requirement; they are used only to verify that the data collection account has the required Read access.

GPO edit permissions (optional)

Important This privilege is required only when you enable automatic audit policy configuration in ADAudit Plus. If you choose manual audit policy configuration, this permission is not required.

Purpose: When automatic audit policy configuration is enabled, ADAudit Plus edits the audit policy settings inside the Default Domain Controllers Policy GPO. Unlike file server, Windows server, and endpoint auditing (where ADAudit Plus creates a new GPO), for domain controllers, ADAudit Plus modifies the existing default policy.

Location: Group Policy Management Console > Default Domain Controllers Policy > Delegation tab > Advanced > Permissions > Edit Settings

Required permission: Edit settings permission on the Default Domain Controllers Policy GPO.

Access behavior:

• Domain Admins already have this permission.
• Least-privilege accounts must be delegated only the ability to edit settings on this specific GPO.

Note This permission applies only to the Default Domain Controllers Policy GPO. ADAudit Plus does not create a new GPO for domain controllers—it edits the existing one.

Remote WMI/DCOM/RPC access (optional)

Important This privilege is required only when you want to check the audit policy configuration status of domain controllers from the ADAudit Plus UI. It is not required for audit data collection itself.

Purpose: Required for querying audit policy status and system configuration from domain controllers via the ADAudit Plus web console. These interfaces allow ADAudit Plus to remotely verify whether the correct audit policies are enabled on each domain controller.

Where to apply: These permissions must be configured on each domain controller that you want to check audit policy status for from the ADAudit Plus UI.

Note The WMI/DCOM/RPC privilege requirements are identical for file servers, Windows servers, and endpoints. The detailed steps below apply to all data source types—only the target machines differ.

WMI permissions

Location:

• WMI Control > Properties > Security tab > Root > CIMV2 > Security
• WMI Control > Properties > Security tab > Root > RSOP > Computer > Security

Required rights (for both namespaces):

• Execute Methods
• Enable Account
• Remote Enable

DCOM permissions

Location: Component Services > Computers > My Computer > Properties > COM Security

Required rights:

• Local Launch
• Remote Launch
• Local Activation
• Remote Activation

RPC requirements

RPC is used automatically by Windows for remote management and does not require separate configuration unless restricted by firewall or security-hardening policies.