Prerequisites

[!] Important: Complete all prerequisite checks before deploying the agent. Missing prerequisites are the most common cause of installation failures.

Requirements Summary

#	Requirement	Details
1	ADAudit Plus	Any version, installed and accessible via the web console
2	License	No specific license required — agent is included in all editions
3	Target OS	Windows Vista+ (client) or Windows Server 2008+ (server). See details
4	.NET Framework	4.8 or higher on the target machine. See details
5	Disk space	Minimum 2 GB for installation + 2–10 GB for EventData cache
6	Privileges	Domain Admin for console-based install; Local System for agent runtime. See Privileges Required
7	Network	Outbound HTTPS on port 8555 from agent to server (or NAT gateway). See details
8	Antivirus	Exclusions required for agent directory, executables, and ports. See details
9	Time sync	NTP or domain controller time synchronization recommended

Supported Endpoint Environments

The ADAudit Plus agent can be installed on:

Environment	Supported
Physical machines	✅ Desktops and servers
Persistent VDI	✅ Full Clone VMs (VMware Horizon, Citrix Virtual Apps & Desktops)
Non-persistent VDI	✅ Linked Clone VMs
Cloud desktops	✅ Azure Virtual Desktop (AVD), other cloud-hosted Windows VMs

Supported Operating Systems

Client Operating Systems

• Windows Vista
• Windows 7
• Windows 8 / 8.1
• Windows 10
• Windows 11

Server Operating Systems

• Windows Server 2008 / 2008 R2
• Windows Server 2012 / 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022

Note: Both 32-bit and 64-bit architectures are supported where applicable.

Disk Space & EventData Directory

Component	Size	Notes
Agent installation	2 GB minimum	Fixed installation path: C:\Program Files\ManageEngine\ADAudit Plus Agent\
EventData directory	2 GB default (configurable up to 10 GB)	Local cache for audit events when the server is unreachable

How EventData works:

• When the agent cannot forward data to the ADAudit Plus server (network disruption, server downtime), events are cached locally in the EventData directory.
• When connectivity is restored, cached events are forwarded to the server.
• Increasing the EventData size allows the agent to hold data longer during outages, preventing data loss if older security logs are overwritten on the endpoint.

[!] Important: When the EventData directory reaches its size limit, the agent stops collecting new data but continues running and attempting to send cached data to the server. Once data is forwarded and space is freed, collection resumes automatically.

To configure EventData directory size:

1. Log in to the ADAudit Plus web console.
2. Navigate to Admin → Agent Settings → Event Data Settings → Maximum Size of EventData Directory.
3. Enter the desired size and click Save.

Note: If increasing beyond 2 GB, ensure the total disk space accommodates both the agent installation and the EventData directory. Example: 2 GB (agent) + 5 GB (EventData) = 7 GB total.

.NET Framework

The ADAudit Plus agent requires .NET Framework 4.8 or higher.

OS	.NET 4.8 Status
Windows Server 2012+ / Windows 8+	✅ Included by default
Windows Server 2008 / 2008 R2 / Windows 7	❌ Manual installation required

Download: .NET Framework

To verify the installed .NET Framework version:

4. On the target machine, navigate to %windir%\Microsoft.NET\Framework.
5. Look for folders starting with v4.0 or higher.

Note: The agent will not function correctly if the required .NET Framework version is missing.

Antivirus Exclusions

To ensure uninterrupted agent operation, add the following exclusions to your antivirus/endpoint protection software:

Directories

Exclude	Location
Agent installation directory	C:\Program Files\ManageEngine\ADAudit Plus Agent\

Executables

Exclude	Where	Purpose
ADAuditPlusAgent.exe	Agent machine	Event collection and forwarding
AgentService.exe	Agent machine	Agent Windows service
recomsvc.exe	Agent machine (target)	Used during agent installation/uninstallation
remcom.exe	ADAudit Plus server	Used during remote agent installation
remoteExec.exe	ADAudit Plus server	Used during remote agent installation

Ports

Port	Protocol	Purpose
TCP 8555	HTTPS	Primary agent-to-server communication
TCP 8081	HTTP	Fallback (product web port)
TCP 8444	HTTPS	Fallback (product web port)

Note: Failure to exclude these directories, executables, or ports may result in delayed event collection, blocked communication, or failed agent installation.

Network & Firewall

Scenario 1: Direct Connection (No NAT)

Agent ──── HTTPS (8555) ────→ ADAudit Plus Server

Rule	Direction	Port	Protocol
Agent machine	Outbound	8555	HTTPS
ADAudit Plus server	Inbound	8555	HTTPS

Scenario 2: With Public Endpoint (Reverse Proxy / Load Balancer / Application Gateway / NAT)

Agent ──── HTTPS (public endpoint port) ────→ Public Endpoint ──── 8555/8444 ────→ ADAudit Plus Server

Rule	Direction	Port	Protocol
Agent machine	Outbound to public endpoint FQDN	Public endpoint port (e.g., 443)	HTTPS
Public endpoint	Inbound	Public endpoint port	HTTPS
Public endpoint	Outbound to ADAudit Plus server	8555, 8444	HTTPS
ADAudit Plus server	Inbound	8555, 8444	HTTPS

[!] Important: When a Public Endpoint is configured, agents must connect using the public endpoint FQDN and port — not the internal ADAudit Plus server hostname or IP.

Server-to-Agent Ports (RPC — optional)

Required only if managing agents directly from the ADAudit Plus console:

Port	Purpose	Direction
TCP 135	RPC Endpoint Mapper	Server → Agent
TCP 49152–65535	RPC Dynamic Ports	Server → Agent

Note: No inbound rules are required on agent machines for HTTPS-only deployments.

Time Synchronization

Ensure all endpoints and the ADAudit Plus server have accurate and synchronized time. Correct time is critical for:

• Proper auditing and event timestamping
• Correlating logs across systems
• Agent-server authentication

Tip: Use NTP or domain controller time synchronization.

Public Endpoint Configuration (Cloud-Hosted)

Navigation: Admin → Network & Communication Settings → Public Endpoint

In cloud-hosted deployments where the ADAudit Plus server resides in a private subnet, agents cannot reach the server directly. A public-facing endpoint (reverse proxy, load balancer, application gateway, or NAT) must be placed in front of the server. This page tells ADAudit Plus — and all deployed agents — what that public endpoint address is.

The page shows two sections:

Internal Server Endpoint (read-only)

This is the server's own address on the internal network. Agents connecting directly (without a public endpoint) use this.

Protocol	Hostname	Port
HTTPS	adaudit.company.local	8555

Public Endpoint (configurable)

Configure this field with the public FQDN and port of your gateway. All agents automatically adopt these settings.

Protocol	Public FQDN	Port
HTTPS	audit.company.com	443

*Configure the public endpoint used by ADAudit Plus agents. This endpoint may be exposed through NAT, Reverse Proxy, Application Gateway, Load Balancer, or other secure gateway technologies.*

When to configure: Required for any cloud-hosted deployment where agents connect through a public-facing gateway. Not required for on-premises deployments where agents can reach the server directly.

Effect: Once saved, agents automatically use the public FQDN and port for their connection. No per-agent reconfiguration is needed.

Supported Public Endpoint Technologies

Any technology that can receive inbound HTTPS traffic and forward it to the ADAudit Plus server on port 8555 is supported.

Cloud Provider	Supported Options
AWS	Application Load Balancer (ALB), Network Load Balancer (NLB), EC2 NAT instance, API Gateway, AWS PrivateLink
Microsoft Azure	Azure Application Gateway, Azure Load Balancer, Azure Front Door, Azure NAT Gateway
Google Cloud Platform	Cloud Load Balancing, Cloud NAT, GCP HTTPS Load Balancer
Oracle Cloud (OCI)	OCI Load Balancer, reverse proxy VM
IBM Cloud	IBM Cloud Load Balancer, reverse proxy VM
Any platform	Self-managed reverse proxy (e.g. NGINX, HAProxy) on a dedicated VM