Troubleshooting

Windows Server is not listed in ADAudit Plus

Symptom

The expected Windows Server does not appear in ADAudit Plus after product-console or bulk configuration.

Resolution

• Re-add the server from Server Audit > Configured Servers > Member Servers.
• If you used bulk import, confirm servers.csv is in the ADAudit Plus bin folder and saved as UTF-8.
• Confirm the server name is correct and reachable from the ADAudit Plus server.
• Rerun cmdUtil.bat if the bulk import did not complete.

ADAudit Plus cannot read Security events

Symptom

The server is configured, but ADAudit Plus cannot read Security events.

Resolution

• Review Agentless privileges for Windows Server auditing, especially Security log access and Event Log Readers membership.
• Confirm the domain data collection identity is configured correctly.
• Confirm the Security log is available and not restricted by local hardening policies.

Audit policy status shows not configured

Symptom

ADAudit Plus shows that audit policy is not configured for one or more Windows Servers.

Resolution

• Verify ADAuditPlusMSPolicy and its security filtering.
• Confirm the target server computer account is a member of ADAuditPlusMS for manual configuration.
• Run Group Policy Results (gpresult) for the target server.
• Allow Group Policy refresh and replication to complete.

Expected events are missing in Event Viewer

Symptom

Test activity occurs, but matching Security events are not generated on the Windows Server.

Resolution

• Confirm the relevant advanced or legacy audit policy is enabled.
• Enable the recommended audit policy settings in Recommended advanced audit policy settings or Recommended legacy audit policy settings.
• Force a Group Policy update (gpupdate /force) if required.
• Repeat the test activity and check Event Viewer again.

Events exist in Event Viewer but not in ADAudit Plus

Symptom

Security events are generated on the server, but they do not appear in ADAudit Plus reports.

Resolution

• Allow time for collection to complete.
• Verify network connectivity between ADAudit Plus and the monitored server.
• If agent-based collection is used, verify agent health and communication status.
• Confirm data collection account privileges for agentless collection.

Security events are overwritten quickly

Symptom

Reports show gaps, or older Security events are no longer available on the server.

Resolution

• Increase the Security log size so it retains 12 to 24 hours of events.
• Confirm the retention method is Overwrite events as needed.
• Review event volume and increase the log size further for high-volume servers.

cmdUtil.bat bulk import fails

Symptom

Bulk import does not add the expected Windows Servers.

Resolution

• Confirm servers.csv is in the ADAudit Plus bin folder.
• Confirm the file is saved as UTF-8 and contains one server name per line.
• Use ADAudit Plus administrator credentials when prompted.
• Rerun the appropriate config server add command.

Frequently asked questions (FAQ)

Q1. Should I use automatic or manual audit policy configuration?

You should use automatic configuration if the data collection identity has the required GPO permissions. Use manual configuration if your organization requires administrators to create and manage GPOs directly.

Q2. Can I configure more than 100 Windows Servers from the product console?

Yes, you can configure more than 100 Windows Servers from the product console. For large batches, use the cmdUtil.bat bulk import workflow described in Add Windows Servers in bulk. For large batches, use the cmdUtil.bat bulk import workflow described in Add Windows Servers in bulk.

Q3. Why should the Security log retain 12 to 24 hours of events?

The Security log retention window of 12 to 24 hours helps prevent event loss during temporary network issues, high event volume, or collection delays.

Q4. Can I use a least-privilege account instead of Domain Admin?

Yes, you can use a least-privilege account instead of Domain Admin. Use Agentless privileges for Windows Server auditing to assign the required rights to the Domain Data Collection Account.