Configuration

Configure Windows workstations in ADAudit Plus

Add Windows workstations using the product console

Use the product console to add and review workstations from the ADAudit Plus web console. The workstations page can display up to 1,000 workstations on a single page, and pagination is available for larger lists.

Navigation note: Workstation configuration is available under the Server Audit tab. In ADAudit Plus, this tab includes both Windows member server auditing and workstation auditing.

1. Log in to the ADAudit Plus web console.
2. Click the Server Audit tab.
3. Under Configured Server(s) in the left pane, click Workstations.
4. Select the required domain from the Domain drop-down.
5. Click + Add Workstation(s).
6. Select the workstations that must be monitored.
7. Click OK.
8. Confirm that the selected workstations appear in the configured Workstations list.

Note: Workstation auditing uses the ADAudit Plus agent for client-side real-time collection.

Add Windows workstations in bulk

Use the command-line workflow when adding workstations in bulk.

1. On the ADAudit Plus server, go to the bin folder:

   <installation_dir>\ManageEngine\ADAudit Plus\bin

2. Create a CSV file named servers.csv in UTF-8 format.
3. Enter one workstation name per line. Example:
   • Test-WS1
   • Test-WS2
   • Test-WS3
4. Open Command Prompt as an administrator.
5. Navigate to the ADAudit Plus bin folder.
6. Run:

   cmdUtil.bat

7. Authenticate using ADAudit Plus administrator credentials.
8. Optional: Enter server usage to view command help.
9. Run the appropriate config server add command.

Bulk configuration command reference

Use the following syntax to add workstations in bulk:

config server add -machinetype ws -isauditpolicy true|false

Parameter	Value	Description
-machinetype	ws	Adds machines as Windows workstations.
-isauditpolicy	true	ADAudit Plus automatically configures the required audit policies through GPO.
-isauditpolicy	false	Audit policies must be configured manually.

Examples:

• Add workstations and automatically configure audit policies:

  config server add -machinetype ws -isauditpolicy true

• Add workstations and configure audit policies manually:

  config server add -machinetype ws -isauditpolicy false

Verify workstation configuration

After adding workstations:

1. Go to Server Audit > Configured Server(s) > Workstations.
2. Select the required domain.
3. Confirm that the expected workstations are listed.
4. Check audit policy or agent-related status for each workstation.
5. Resolve any error or warning shown in the status column.

Configure audit policies

Why audit policies are required

Audit policies control which activities Windows writes to the event logs. ADAudit Plus reports can show reliable workstation audit data only when the required event categories and subcategories are enabled on monitored workstations.

Automatic audit policy configuration

ADAudit Plus can automatically configure the required audit policies for workstation auditing.

When automatic audit policy configuration is enabled, ADAudit Plus creates and uses a dedicated workstation GPO and security group:

Item	Value
GPO name	<DomainName>_ADAuditPlusWSPolicy
Security group	ADAuditPlusWS—Domain Local group in CN=Users

Navigation note: Workstation audit policy configuration is available under the Server Audit tab because ADAudit Plus groups Windows Server and workstation configuration under that tab.

1. Log in to the ADAudit Plus web console.
2. Click the Server Audit tab.
3. Under Configured Server(s) in the left pane, click Workstations.
4. Select the required domain from the Domain drop-down menu.
5. Click Audit Policy: Configure.
6. Wait for the configuration status to update.

Note: Automatic audit policy configuration uses GPO-based configuration and requires the privileges documented in Agentless privileges for workstation and endpoint auditing.

Manual audit policy configuration overview

Manual configuration uses a dedicated GPO and security filtering group so the settings apply only to monitored workstations.

High-level steps:

1. Create a domain local security group named ADAuditPlusWS.
2. Add monitored workstation computer accounts as members of ADAuditPlusWS.
3. Create and link a GPO named <DomainName>_ADAuditPlusWSPolicy for manual configuration.
4. Remove Authenticated Users from Security Filtering.
5. Add ADAuditPlusWS to Security Filtering.
6. Configure advanced or legacy audit policy settings in <DomainName>_ADAuditPlusWSPolicy.
7. Configure security log settings in <DomainName>_ADAuditPlusWSPolicy.

Configure the workstation security filtering group

1. Open Active Directory Users and Computers.
2. Right-click the domain and select New > Group.
3. In the New Object - Group window, configure:

   Field	Value
   Group name	ADAuditPlusWS
   Group scope	Domain Local
   Group type	Security

4. Click OK.
5. Right-click the newly created group and select Properties.
6. Go to Members > Add.
7. Add all workstation computer accounts that must be audited.
8. Open Group Policy Management Console (GPMC).
9. Right-click the domain and select Create a GPO in this domain, and Link it here.
10. Name the GPO <DomainName>_ADAuditPlusWSPolicy and click OK.
11. Select the <DomainName>_ADAuditPlusWSPolicy GPO.
12. Under Security Filtering, remove Authenticated Users.
13. Add the ADAuditPlusWS group.

Configure advanced audit policies

Use advanced audit policies for modern Windows versions. Advanced audit policies provide granular control over which activities are logged and help reduce event noise.

1. Right-click <DomainName>_ADAuditPlusWSPolicy and select Edit.
2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies.
3. Configure the settings listed in the advanced audit policy settings below:

Enforce advanced audit policy settings

When using advanced audit policies, ensure that advanced audit policy subcategory settings override legacy policy category settings.

1. Edit <DomainName>_ADAuditPlusWSPolicy.
2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
3. Enable audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings.

Configure legacy audit policies

Legacy audit policies apply only to older environments where advanced audit policies are not available.

Important: Windows XP and Windows Vista have reached EOL. This section is retained only as legacy reference material and should not be treated as a recommendation for new deployments.

1. Right-click <DomainName>_ADAuditPlusWSPolicy and select Edit.
2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy.
3. Configure the settings listed below:

Recommended advanced audit policy settings

Category	Subcategory	Audit events
Account Management	Audit Computer Account Management	Success
Account Management	Audit Distribution Group Management	Success
Account Management	Audit Security Group Management	Success
Account Management	Audit User Account Management	Success, Failure
Detailed Tracking	Audit PNP Activity	Success, Failure
Logon/Logoff	Audit Logoff	Success
Logon/Logoff	Audit Logon	Success, Failure
Logon/Logoff	Audit Network Policy Server	Success, Failure
Logon/Logoff	Audit Other Logon/Logoff Events	Success, Failure
Object Access	Audit File Share	Success, Failure
Object Access	Audit File System	Success, Failure
Object Access	Audit Handle Manipulation	Success
Object Access	Audit Other Object Access Events	Success
Object Access	Audit Removable Storage	Success, Failure
Policy Change	Audit Authentication Policy Change	Success
Policy Change	Audit Authorization Policy Change	Success
System	Audit Security State Change	Success

Recommended legacy audit policy settings

Category	Audit events
Audit account management	Success, Failure
Audit logon events	Success
Audit object access	Success, Failure
Audit policy change	Success
Audit system events	Success

Configure security log settings

Why security log sizing matters

Windows workstations can generate a high volume of security events after audit policies are enabled. If the security log is too small or retention is not configured correctly, events can be overwritten before ADAudit Plus collects them.

Size the security log so it can retain at least 12 hours of events for the activity level in your environment.

Configure security log retention

1. Edit <DomainName>_ADAuditPlusWSPolicy.
2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Event Log.
3. Open Retention method for security log.
4. Select Define these policy settings.
5. Select Overwrite events as needed.
6. Click OK.
7. Open Maximum security log size.
8. Configure the log size using the guidance in the recommended security log size below:

Recommended security log size

Role	OS	Baseline size
Windows workstation	Windows 11, Windows 10, Windows 8/8.1, Windows 7	512MB
Windows workstation	Windows Vista and Windows XP	512MB (legacy reference only)

Note: The baseline size is a starting point. Increase the security log size if the workstation cannot retain at least 12 hours of security events.

Verify the configuration

Verify audit policies and security log settings

Use gpresult to verify that the expected settings apply to a monitored workstation.

1. Open Command Prompt as an administrator.
2. Run:

   gpresult /S <monitored_computer> /F /H gpresult_output.html

3. Open the generated gpresult_output.html report.
4. Verify that the audit policy settings are applied.
5. Verify that security log retention and size match configured security log settings.

Verify expected events on monitored workstations

Use Event Viewer to confirm that Windows is generating events before troubleshooting ADAudit Plus reports.

1. Open Run.
2. Enter:

   eventvwr.msc

3. In Event Viewer, connect to the target workstation if required.
4. Open Windows Logs > Security.
5. Right-click Security and select Filter Current Log.
6. Filter by time range or by a specific event ID that corresponds to the enabled audit policy.
7. Confirm that valid events appear in the security log.
8. After collection, verify that the events appear in the relevant ADAudit Plus report.