Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for Windows workstation auditing. In this guide, Windows workstations refer to domain-joined Windows endpoint computers such as user desktops and laptops.

Follow this setup workflow before relying on workstation audit reports for audit, investigation, productivity review, compliance, or user behavior analytics:

1. Configure Windows workstations in ADAudit Plus.
2. Choose the data collection method and plan required ports.
3. Deploy or use the ADAudit Plus agent where required for workstation-scale collection.
4. Configure the required audit policies on monitored workstations.
5. Configure security event log retention and size.
6. Verify that expected Windows events are generated and collected.
7. Review dashboards, reports, and alerts for workstation activity.

What ADAudit Plus audits on Windows workstations

ADAudit Plus helps audit and report on user and system activity across monitored Windows workstations, including:

1. Local logon and logoff activity.
2. User logon history and session duration.
3. Productive hours, idle time, startup time, and shutdown time.
4. Remote login and terminal services activity.
5. Process creation and termination.
6. Scheduled task activity.
7. Removable storage activity such as USB usage.
8. Local administrator group and local user account changes.
9. Account creation, deletion, modification, and lockout activity.
10. Critical system, configuration, and program file integrity activity.
11. Anomalous login behavior that may indicate insider risk or compromised credentials.

Note: File integrity activity can also have dedicated feature guidance. It is still listed here because workstation auditing reports may include workstation file integrity signals where configured.

Supported Windows workstation OS versions

ADAudit Plus workstation auditing can be configured for supported Windows workstation OSs used in your environment.

Windows workstation OS version	Status
Windows 11	Supported for workstation auditing.
Windows 10	Supported for workstation auditing.
Windows 8/8.1	Supported for workstation auditing.
Windows 7	Supported for workstation auditing.

Legacy reference: Windows Vista and Windows XP have both reached EOL and should not be used for new deployments. Legacy references are retained only for older environments.