Privileges

Agentless privileges for Windows File Server auditing

The privileges in this section apply when ADAudit Plus uses the Domain Data Collection Account for agentless File Server auditing, share discovery, Security log access, SACL configuration, or automatic audit policy configuration.

This module requires a Windows domain identity with the privileges listed below. This identity can be provided by either:

• The ADAudit Plus Service Account: If the service runs as a domain user or gMSA with the required privileges (simplest single-domain setup)
• A Data Collection Account configured in Domain Settings: Required when the Service Account is Local System, or for additional domains

The same identity is shared by AD/GPO, Windows Server, and Windows Endpoint auditing within the same domain.

Privilege summary

#	Privilege	Required?	Purpose
1	Manage Auditing and Security Log	✅	Read Security event log + configure SACLs on files/folders
2	Membership in Event Log Readers Group	✅	Read Security and System logs
3	Read Access to AD Objects & Naming Contexts	✅	Resolve AD user/group information for file access events
4	Membership in Power Users Group	✅	Discover shares on File Servers
5	Read Permission on Audited Shares	✅	Access audited shares for file audit processing
6	GPO Create Permissions	⚠️ Optional	Only for Automatic Audit Policy Configuration
7	Remote WMI/DCOM/RPC Access	⚠️ Optional	Only for checking audit policy status from the UI

Note: Domain Admin accounts already have all these privileges. The details below are only needed when configuring a least-privilege account.

Manage Auditing and Security Log

Purpose: Required for reading the Security event log and configuring Object-level auditing (SACL) on file system objects.

Location: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Manage auditing and security log

Can be assigned via GPO targeting File Servers or locally on each server.

Privilege behavior:

• Grants the ability to read the security event log on File Servers
• Required to set and read SACLs on files and folders
• Least-privilege accounts must be explicitly assigned this right

Membership in Event Log Readers Group

Purpose: Required for reading Windows event logs (Security, System) on File Servers to audit file access, modification, deletion, and permission changes.

Location: Assign via GPO or directly on each File Server:

GPO: Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups > add to local Event Log Readers group

Local: Computer Management > Local Users and Groups > Groups > Event Log Readers

Default access behavior: File Servers do not automatically add domain users to the local Event Log Readers group; explicit membership is required.

Read Access to Active Directory Objects & Naming Contexts

Purpose: Required for resolving Active Directory (AD) user/group information related to file access events on File Servers.

The Data Collection Account requires Read access on these AD naming contexts:

Naming context	Example
Default naming context / Domain partition	LDAP://DC=domain,DC=com
Configuration naming context	LDAP://CN=Configuration,DC=domain,DC=com
Schema naming context	LDAP://CN=Schema,CN=Configuration,DC=domain,DC=com
RootDSE	LDAP://RootDSE
DomainDnsZones application partition	LDAP://DC=DomainDnsZones,DC=domain,DC=com
ForestDnsZones application partition	LDAP://DC=ForestDnsZones,DC=domain,DC=com

Standard domain users have this access by default unless custom ACLs or hardened baselines restrict directory reads.

Membership in Power Users Group

Purpose: Required for discovering shares on Windows File Servers. Members of the Power Users group can enumerate shares.

Location: Assign via GPO or directly on each File Server:

• GPO: Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups > add to local Power Users group
• Local: Computer Management > Local Users and Groups > Groups > Power Users

Default access behavior: Domain users are not automatically added to Power Users. Explicit membership is required.

Read permission on Audited Shares

Purpose: Required to access audited shares for file audit processing.

Required rights: The Data Collection Account must have Read permission on all audited shares via either:

Method 1: Grant Local Administrators Group membership

Add the Data Collection Account to the Local Administrators group on the File Server.

Method 2: Grant Share Read and NTFS Read permissions

Assign both Share Read and NTFS Read permissions on each audited share:

• Open Shared Folders snap-in > target share > Properties > Security > Edit.
• Add the Data Collection Account.
• Grant both Share Read and NTFS Read permissions.
• Repeat for every audited share.

GPO Create Permissions (Optional)

Important: This privilege is required only when Automatic Audit Policy Configuration is enabled. If you configure audit policies manually, skip this section.

Purpose: When enabled, ADAudit Plus:

• Creates a GPO named <DomainName>_ADAuditPlusPolicy
• Creates a Domain Local Security group ADAuditPlusFS in CN=Users

GPO Permissions

Location: Group Policy Management Console > {Domain Name} > Group Policy Objects

• Create GPO (via Group Policy Creator Owners or delegated rights)
• Edit settings on the <DomainName>_ADAuditPlusPolicy GPO
• Link GPO at domain level

AD Security Group Permissions

Location: CN=Users container in AD

• Create Group objects (to create ADAuditPlusFS)
• Write Members (to add/remove File Server computer accounts)

How Targeting Works

The GPO is linked at the domain level. Security Filtering via the ADAuditPlusFS group ensures it applies only to monitored File Servers. Computer accounts are added/removed from the group as servers are added/removed from auditing.

Note: This same GPO and group (ADAuditPlusPolicy + ADAuditPlusFS) is shared with Windows Server auditing.

Remote WMI/DCOM/RPC Access (Optional)

Important: This privilege is required only when you want to check the audit policy configuration status of File Servers from the ADAudit Plus UI. It is not required for audit data collection itself.

Purpose: Required for querying audit policy status and system configuration from File Servers via the ADAudit Plus web console.

Where to apply: These permissions must be configured on each File Server that you want to check audit policy status for from the ADAudit Plus UI.

Component	Required Rights
WMI (CIMV2, RSOP\Computer)	Execute Methods, Enable Account, Remote Enable
DCOM (COM Security)	Local Launch, Remote Launch, Local Activation, Remote Activation
RPC	No separate configuration (used automatically by Windows)

For WMI namespace security, use WMI Control > Properties > Security. For DCOM launch and activation settings, use Component Services > Computers > My Computer > Properties > COM Security.