Overview

Purpose of Agent Installation

The ADAudit Plus agent is a lightweight Windows service that collects audit data from domain controllers, servers, and workstations. Installing the agent ensures:

• Centralized auditing — consolidates audit data from multiple endpoints into the ADAudit Plus server
• Minimal user intervention — runs in the background with minimal maintenance once deployed
• Reliable data collection — ensures consistent audit data capture even in complex or geographically distributed environments

Note: This guide covers the Windows agent only. The macOS agent is covered in a separate document.

Benefits

Benefit	Description
Real-time data collection	Captures logon events, user activities, and AD changes immediately as they occur
Improved accuracy	Minimizes missed events compared to remote, agentless polling methods
VDI & cloud support	Works with virtual desktops, VMs, cloud-hosted endpoints, and geographically distributed machines
Optimized network usage	Reduces bandwidth utilization through efficient, batched data transfer
Lightweight	Minimal CPU, RAM, and disk usage (see details)
Server load reduction	Collects and parses audit data locally, reducing processing overhead on the ADAudit Plus server
No admin privileges needed on endpoints	The ADAudit Plus server does not need administrative privileges on endpoints
No RPC ports needed for data collection	Agent pushes data to the server over HTTPS — no inbound RPC ports required on endpoints
Encrypted communication	All agent-to-server communication is over HTTPS
Scalability	Handles hundreds or thousands of endpoints efficiently
Offline resilience	Temporarily stores audit data locally (EventData directory) and synchronizes when connectivity is restored

Resource Usage

Resource	Typical Usage
CPU	1-2%
RAM	65-75 MB
Disk (agent installation)	~2 GB
Disk (EventData cache)	2 GB default (configurable up to 10 GB)
Network	HTTPS on port 8555 (configurable)