Configuration

Configure Windows Servers in ADAudit Plus

Add Windows Servers using the product console

Use the product console when adding up to 100 Windows Servers at a time.

1. Log in to the ADAudit Plus web console.
2. Click the Server Audit tab.
3. Go to Configured Servers, then Member Servers.
4. Click Add Server.
5. Select or enter the Windows Servers that must be audited.
6. Complete the wizard.
7. In the final step, choose whether ADAudit Plus should automatically configure the required audit policies:
   • Select Yes to allow ADAudit Plus to configure audit policies automatically.
   • Select No if you will configure audit policies manually.

Note: Automatic audit policy configuration requires the privileges documented in Agentless privileges for Windows Server auditing.

Add Windows Servers in bulk

Use the command-line workflow when adding many Windows Servers.

1. On the ADAudit Plus server, go to the bin folder: <installation_dir>\ManageEngine\ADAudit Plus\bin
2. Create a CSV file named servers.csv in UTF-8 format.
3. Enter one Windows Server name per line.

   Example:

   Test-MS1
   Test-MS2
   Test-MS3

4. Open Command Prompt as an administrator.
5. Navigate to the ADAudit Plus bin folder.
6. Run the Command Prompt from this folder, then enter the following command:

   cmdUtil.bat

7. Authenticate using ADAudit Plus administrator credentials.
8. Run the appropriate config server add command described in Bulk configuration command reference.

Bulk configuration command reference

Use the following syntax to add Windows Servers in bulk:

config server add -machinetype ms -isauditpolicy true|false

Parameter	Value	Description
-machinetype	ms	Adds machines as Windows member servers.
-isauditpolicy	true	ADAudit Plus automatically configures the required audit policies.
-isauditpolicy	false	Audit policies must be configured manually.

Example 1: Add Windows Servers and automatically configure audit policies:

config server add -machinetype ms -isauditpolicy true

Example 2: Add Windows Servers and configure audit policies manually:

config server add -machinetype ms -isauditpolicy false

Verify Windows Server configuration

After adding Windows Servers:

1. Go to Server Audit > Configured Servers > Member Servers.
2. Confirm that the expected servers are listed.
3. Check whether the audit policy configuration status is shown for each server.
4. Resolve any error or warning shown in the status column.

Configure audit policies

Why audit policies are required

Audit policies control which activities Windows writes to the event logs. ADAudit Plus reports can show reliable Windows Server audit data only when the required event categories and subcategories are enabled on monitored servers.

Automatic audit policy configuration

ADAudit Plus can automatically configure the required audit policies for Windows Server auditing.

When automatic audit policy configuration is enabled, ADAudit Plus uses the same GPO and security group model as Windows File Server auditing, as shown in the following table.

Item	Value
GPO name	<DomainName>_ADAuditPlusPolicy
Security group	ADAuditPlusFS (Domain Local group in CN=Users)

1. Log in to the ADAudit Plus web console.
2. Click the Server Audit tab.
3. Go to Configured Servers, then Member Servers.
4. Click Audit Policy: Configure.
5. Choose Yes when prompted to let ADAudit Plus configure the required audit policies.
6. Wait for the configuration status to update.

Note: Automatic audit policy configuration uses GPO-based configuration and requires the privileges documented in Agentless privileges for Windows Server auditing.

Manual audit policy configuration overview

Manual configuration uses a dedicated GPO and security filtering group so the settings apply only to monitored Windows Servers.

High-level steps:

1. Create a domain local security group named ADAuditPlusMS.
2. Add monitored Windows Server computer accounts as members of ADAuditPlusMS.
3. Create and link a GPO named ADAuditPlusMSPolicy for manual configuration.
4. Remove Authenticated Users from Security Filtering.
5. Add ADAuditPlusMS to Security Filtering.
6. Configure advanced or legacy audit policy settings in ADAuditPlusMSPolicy.
7. Configure Security log settings in ADAuditPlusMSPolicy.

Note: Automatic configuration uses <DomainName>_ADAuditPlusPolicy and ADAuditPlusFS. The ADAuditPlusMS group and ADAuditPlusMSPolicy GPO in this section are for manual Windows Server audit policy configuration.

Configure the Windows Server security filtering group

1. Open Active Directory Users and Computers.
2. Right-click the domain and select New, then Group.
3. In the New Object - Group window, configure the following fields:
   1. Group name: ADAuditPlusMS
   2. Group scope: Domain Local
   3. Group type: Security
4. Click OK.
5. Right-click the newly created group and select Properties.
6. Go to Members > Add.
7. Add all Windows Server computer accounts that must be audited.
8. Open Group Policy Management Console (GPMC).
9. Right-click the domain and select Create a GPO in this domain, and Link it here.
10. Name the GPO ADAuditPlusMSPolicy and click OK.
11. Select the ADAuditPlusMSPolicy GPO.
12. Under Security Filtering, remove Authenticated Users.
13. Add the ADAuditPlusMS group.

Configure advanced audit policies

Use advanced audit policies for Windows Server 2008 and later. Advanced audit policies provide granular control over which activities are logged and help reduce event noise.

1. Open Group Policy Management on your domain controller or management machine.
2. Expand Forest > Domains > your domain.
3. Right-click ADAuditPlusMSPolicy and select Edit.
4. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies
5. Configure the settings listed in Recommended advanced audit policy settings.

Enforce advanced audit policy settings

When using advanced audit policies, ensure that advanced audit policy subcategory settings override legacy policy category settings.

1. Open Group Policy Management on your domain controller or management machine.
2. Expand Forest > Domains > your domain.
3. Edit ADAuditPlusMSPolicy.
4. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
5. Enable Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.

Configure legacy audit policies

Legacy audit policies apply only to older environments where advanced audit policies are not available.

Important: Windows Server 2003 / 2003 R2 has passed end-of-life support from Microsoft. This section is retained only as legacy reference material and should not be treated as a recommendation for new deployments.

1. Open Group Policy Management on your domain controller or management machine.
2. Expand Forest > Domains > your domain.
3. Right-click ADAuditPlusMSPolicy and select Edit.
4. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy
5. Configure the settings listed in Recommended legacy audit policy settings.

Recommended advanced audit policy settings

Category	Subcategory	Audit events
Account Management	Audit Computer Account Management; Audit Distribution Group Management; Audit Security Group Management	Success
Account Management	Audit User Account Management	Success, Failure
Detailed Tracking	Audit Process Creation; Audit Process Termination	Success
DS Access	Audit Directory Service Changes; Audit Directory Service Access	Success
Logon/Logoff	Audit Logon; Audit Network Policy Server; Audit Other Logon/Logoff Events	Success, Failure
Logon/Logoff	Audit Logoff	Success
Object Access	Audit File System; Audit Handle Manipulation; Audit File Share	Success, Failure
Policy Change	Audit Authentication Policy Change; Audit Authorization Policy Change	Success
System	Audit Security State Change	Success

Recommended legacy audit policy settings

Category	Audit events
Account Logon	Success, Failure
Audit Logon/Logoff	Success, Failure
Account Management	Success
Directory Service Access	Success
Process Tracking	Success
Object Access	Success
System Events	Success

Configure Security log settings

Why Security log sizing matters

Windows Servers can generate a high volume of Security events after audit policies are enabled. If the Security log is too small or retention is not configured correctly, events can be overwritten before ADAudit Plus collects them.

Size the Security log so it can retain at least 12 to 24 hours of events for the activity level in your environment.

Configure Security log retention

1. Edit ADAuditPlusMSPolicy.
2. Navigate to >Computer Configuration > Policies > Windows Settings > Security Settings > Event Log
3. Open Retention method for security log.
4. Select Overwrite events as needed.
5. Open Maximum security log size.
6. Configure the log size using the following baselines:
   • Windows Server 2008 and later: 4,096MB
   • Windows Server 2003 / 2003 R2: 512MB (legacy reference only)

Note: The baseline size is a starting point. Increase the Security log size if the server cannot retain at least 12 to 24 hours of Security events.

Verify the configuration

Verify audit policies and Security log settings

Use Group Policy Results to verify that the expected settings apply to a monitored Windows Server.

1. Open Group Policy Management Console (GPMC).
2. Right-click Group Policy Results.
3. Open the Group Policy Results Wizard.
4. Select the target Windows Server and the current user.
5. Verify that the audit policy settings in Recommended advanced audit policy settings or Recommended legacy audit policy settings are applied.
6. Verify that Security log retention and size match Configure Security log settings.

Verify expected events on monitored Windows Servers

Use Event Viewer to confirm that Windows is generating events before troubleshooting ADAudit Plus reports.

1. Open Run.
2. Enter the following command:

   eventvwr.msc

3. In Event Viewer, connect to the target Windows Server if required.
4. Open Windows Logs, then go to Security.
5. Perform a test action that matches an enabled audit policy, such as a successful local logon.
6. Confirm that a valid corresponding event appears in the Security log.
7. After collection, verify that the event appears in the relevant ADAudit Plus report.

Example: Event ID 4624 is a common successful logon event. You can also verify any other valid event generated by the enabled audit policies and captured by ADAudit Plus