Overview

Purpose of this guide

This guide explains how to prepare ADAudit Plus and your Active Directory environment for real-time Active Directory auditing. Follow this setup workflow before using Active Directory audit reports:

• Configure the Active Directory domain and domain controllers in ADAudit Plus.
• Configure Windows audit policies on domain controllers.
• Configure object-level auditing (SACL) for Active Directory objects.
• Configure Security event log retention and size.
• Verify that the expected Windows events are generated and collected.

Note: For account concepts and least-privilege requirements, see Accounts & Privileges Overview and Agentless privileges for Active Directory and GPO auditing.

What ADAudit Plus audits in Active Directory

ADAudit Plus helps audit changes and activities in on-premises Active Directory, including:

• User account creation, deletion, modification, enable or disable, password changes, and password resets
• Group creation, deletion, membership changes, and group property changes
• Computer account changes
• Organizational unit (OU) changes
• Group Policy Object (GPO) creation, deletion, modification, link changes, and settings changes
• Domain policy changes
• Active Directory permission changes
• Schema and configuration partition changes
• Active-Directory-integrated DNS zone and record changes
• Logon, failed logon, account lockout, Kerberos, and other authentication-related events

Active Directory contexts covered

ADAudit Plus audits activities across the following major Active Directory contexts:

Active Directory context	What it contains	Why it matters for auditing
Domain naming context	Users, computers, groups, OUs, contacts, and other domain objects	Required for user, group, computer, OU, contact, permission, and domain object change auditing
Schema context	Active Directory schema objects and definitions	Required for schema change auditing
Configuration context	Sites, subnets, services, configuration objects, and Active Directory DNS-related objects	Required for configuration, topology, and Active-Directory-integrated DNS auditing