Configuration

    Configure Windows workstations in ADAudit Plus

    Add Windows workstations using the product console

    Use the product console to add and review workstations from the ADAudit Plus web console. The workstations page can display up to 1,000 workstations on a single page, and pagination is available for larger lists.

    Navigation note: Workstation configuration is available under the Server Audit tab. In ADAudit Plus, this tab includes both Windows member server auditing and workstation auditing.

    1. Log in to the ADAudit Plus web console.
    2. Click the Server Audit tab.
    3. Under Configured Server(s) in the left pane, click Workstations.
    4. Select the required domain from the Domain drop-down.
    5. Click + Add Workstation(s).
    6. Select the workstations that must be monitored.
    7. Click OK.
    8. Confirm that the selected workstations appear in the configured Workstations list.

    Note Workstation auditing uses the ADAudit Plus agent for client-side real-time collection.

    Add Windows workstations in bulk

    Use the command-line workflow when adding workstations in bulk.

    1. On the ADAudit Plus server, go to the bin folder:

      <installation_dir>\ManageEngine\ADAudit Plus\bin

    2. Create a CSV file named servers.csv in UTF-8 format.
    3. Enter one workstation name per line. Example:
      • Test-WS1
      • Test-WS2
      • Test-WS3
    4. Open Command Prompt as an administrator.
    5. Navigate to the ADAudit Plus bin folder.
    6. Run:

      cmdUtil.bat

    7. Authenticate using ADAudit Plus administrator credentials.
    8. Optional: Enter server usage to view command help.
    9. Run the appropriate config server add command.

    Bulk configuration command reference

    Use the following syntax to add workstations in bulk:

    config server add -machinetype ws -isauditpolicy true|false

    Parameter Value Description
    -machinetype ws Adds machines as Windows workstations.
    -isauditpolicy true ADAudit Plus automatically configures the required audit policies through GPO.
    -isauditpolicy false Audit policies must be configured manually.

    Examples:

    • Add workstations and automatically configure audit policies:

      config server add -machinetype ws -isauditpolicy true

    • Add workstations and configure audit policies manually:

      config server add -machinetype ws -isauditpolicy false

    Verify workstation configuration

    After adding workstations:

    1. Go to Server Audit > Configured Server(s) > Workstations.
    2. Select the required domain.
    3. Confirm that the expected workstations are listed.
    4. Check audit policy or agent-related status for each workstation.
    5. Resolve any error or warning shown in the status column.

    Configure audit policies

    Why audit policies are required

    Audit policies control which activities Windows writes to the event logs. ADAudit Plus reports can show reliable workstation audit data only when the required event categories and subcategories are enabled on monitored workstations.

    Automatic audit policy configuration

    ADAudit Plus can automatically configure the required audit policies for workstation auditing.

    When automatic audit policy configuration is enabled, ADAudit Plus creates and uses a dedicated workstation GPO and security group:

    Item Value
    GPO name <DomainName>_ADAuditPlusWSPolicy
    Security group ADAuditPlusWS—Domain Local group in CN=Users

    Navigation note: Workstation audit policy configuration is available under the Server Audit tab because ADAudit Plus groups Windows Server and workstation configuration under that tab.

    1. Log in to the ADAudit Plus web console.
    2. Click the Server Audit tab.
    3. Under Configured Server(s) in the left pane, click Workstations.
    4. Select the required domain from the Domain drop-down menu.
    5. Click Audit Policy: Configure.
    6. Wait for the configuration status to update.

    Note Automatic audit policy configuration uses GPO-based configuration and requires the privileges documented in Agentless privileges for workstation and endpoint auditing.

    Manual audit policy configuration overview

    Manual configuration uses a dedicated GPO and security filtering group so the settings apply only to monitored workstations.

    High-level steps:

    1. Create a domain local security group named ADAuditPlusWS.
    2. Add monitored workstation computer accounts as members of ADAuditPlusWS.
    3. Create and link a GPO named <DomainName>_ADAuditPlusWSPolicy for manual configuration.
    4. Remove Authenticated Users from Security Filtering.
    5. Add ADAuditPlusWS to Security Filtering.
    6. Configure advanced or legacy audit policy settings in <DomainName>_ADAuditPlusWSPolicy.
    7. Configure security log settings in <DomainName>_ADAuditPlusWSPolicy.

    Configure the workstation security filtering group

    1. Open Active Directory Users and Computers.
    2. Right-click the domain and select New > Group.
    3. In the New Object - Group window, configure:
      Field Value
      Group name ADAuditPlusWS
      Group scope Domain Local
      Group type Security
    4. Click OK.
    5. Right-click the newly created group and select Properties.
    6. Go to Members > Add.
    7. Add all workstation computer accounts that must be audited.
    8. Open Group Policy Management Console (GPMC).
    9. Right-click the domain and select Create a GPO in this domain, and Link it here.
    10. Name the GPO <DomainName>_ADAuditPlusWSPolicy and click OK.
    11. Select the <DomainName>_ADAuditPlusWSPolicy GPO.
    12. Under Security Filtering, remove Authenticated Users.
    13. Add the ADAuditPlusWS group.

    Configure advanced audit policies

    Use advanced audit policies for modern Windows versions. Advanced audit policies provide granular control over which activities are logged and help reduce event noise.

    1. Right-click <DomainName>_ADAuditPlusWSPolicy and select Edit.
    2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies.
    3. Configure the settings listed in the advanced audit policy settings below:

    Enforce advanced audit policy settings

    When using advanced audit policies, ensure that advanced audit policy subcategory settings override legacy policy category settings.

    1. Edit <DomainName>_ADAuditPlusWSPolicy.
    2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
    3. Enable audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.

    Configure legacy audit policies

    Legacy audit policies apply only to older environments where advanced audit policies are not available.

    Important Windows XP and Windows Vista have reached EOL. This section is retained only as legacy reference material and should not be treated as a recommendation for new deployments.

    1. Right-click <DomainName>_ADAuditPlusWSPolicy and select Edit.
    2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy.
    3. Configure the settings listed below:
    Category Subcategory Audit events
    Account Management Audit Computer Account Management Success
    Account Management Audit Distribution Group Management Success
    Account Management Audit Security Group Management Success
    Account Management Audit User Account Management Success, Failure
    Detailed Tracking Audit PNP Activity Success, Failure
    Logon/Logoff Audit Logoff Success
    Logon/Logoff Audit Logon Success, Failure
    Logon/Logoff Audit Network Policy Server Success, Failure
    Logon/Logoff Audit Other Logon/Logoff Events Success, Failure
    Object Access Audit File Share Success, Failure
    Object Access Audit File System Success, Failure
    Object Access Audit Handle Manipulation Success
    Object Access Audit Other Object Access Events Success
    Object Access Audit Removable Storage Success, Failure
    Policy Change Audit Authentication Policy Change Success
    Policy Change Audit Authorization Policy Change Success
    System Audit Security State Change Success
    Category Audit events
    Audit account management Success, Failure
    Audit logon events Success
    Audit object access Success, Failure
    Audit policy change Success
    Audit system events Success

    Configure security log settings

    Why security log sizing matters

    Windows workstations can generate a high volume of security events after audit policies are enabled. If the security log is too small or retention is not configured correctly, events can be overwritten before ADAudit Plus collects them.

    Size the security log so it can retain at least 12 hours of events for the activity level in your environment.

    Configure security log retention

    1. Edit <DomainName>_ADAuditPlusWSPolicy.
    2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Event Log.
    3. Open Retention method for security log.
    4. Select Define these policy settings.
    5. Select Overwrite events as needed.
    6. Click OK.
    7. Open Maximum security log size.
    8. Configure the log size using the guidance in the recommended security log size below:
    Role OS Baseline size
    Windows workstation Windows 11, Windows 10, Windows 8/8.1, Windows 7 512MB
    Windows workstation Windows Vista and Windows XP 512MB (legacy reference only)

    Note The baseline size is a starting point. Increase the security log size if the workstation cannot retain at least 12 hours of security events.

    Verify the configuration

    Verify audit policies and security log settings

    Use gpresult to verify that the expected settings apply to a monitored workstation.

    1. Open Command Prompt as an administrator.
    2. Run:

      gpresult /S <monitored_computer> /F /H gpresult_output.html

    3. Open the generated gpresult_output.html report.
    4. Verify that the audit policy settings are applied.
    5. Verify that security log retention and size match configured security log settings.

    Verify expected events on monitored workstations

    Use Event Viewer to confirm that Windows is generating events before troubleshooting ADAudit Plus reports.

    1. Open Run.
    2. Enter:

      eventvwr.msc

    3. In Event Viewer, connect to the target workstation if required.
    4. Open Windows Logs > Security.
    5. Right-click Security and select Filter Current Log.
    6. Filter by time range or by a specific event ID that corresponds to the enabled audit policy.
    7. Confirm that valid events appear in the security log.
    8. After collection, verify that the events appear in the relevant ADAudit Plus report.