Prerequisites

Complete these prerequisites before configuring workstation auditing in ADAudit Plus.

Setup order: Complete the prerequisite and configuration steps in order. Skipping agent planning, agentless/status access privileges, audit policies, or security log sizing can result in missing or incomplete workstation audit reports.

Requirements summary

Requirement	Why it is needed
ADAudit Plus administrator access	Required to add workstations and configure auditing settings.
Domain-joined Windows workstations	Workstation auditing targets AD domain-joined endpoint computers.
ADAudit Plus agent where required	Required for scalable client-side real-time workstation data collection.
Domain Data Collection Account or equivalent service identity	Required for agentless access, status checks, and automatic audit policy configuration where applicable.
Required privileges on monitored workstations	Required to read logs and configure or verify audit policy settings.
Data collection method and ports	Required to plan agent-based collection, agentless/status access, or both, and to confirm the correct firewall rules.
Audit policies	Required for Windows to generate the events used by reports.
Security log retention and size	Required to avoid event loss before collection.
Network connectivity	Required for agent-server communication and Windows remote interfaces where used.

Configuration checklist

	Task
1	Confirm the workstations to be audited.
2	Choose the data collection method and confirm port requirements.
3	Configure the ADAudit Plus agent deployment plan where required.
4	Configure the Domain Data Collection Account and privileges where agentless/status access is used.
5	Add workstations in ADAudit Plus.
6	Choose automatic or manual audit policy configuration.
7	Configure advanced audit policies for modern Windows versions.
8	Configure legacy audit policies only for legacy environments where required.
9	Configure security log retention and size.
10	Verify audit policy results and event generation.
11	Review dashboards, reports, and alerts.

Data collection, ports, and privilege planning

Before configuring workstations, decide which data collection method applies to your environment and confirm the related firewall and privilege requirements.

Collection method	When to use
Agent-based collection	Recommended for workstation auditing, especially when many endpoints must be audited with scalable, real-time collection.
Agentless/status access	Use where ADAudit Plus must perform agentless access, remote status checks, or audit policy verification using the Domain Data Collection Account.

Recommendation: Use agent-based collection for endpoint-scale workstation auditing because it provides more scalable and real-time data collection when many endpoints are monitored. Agentless/status access remains available for remote checks or environments where agentless collection is required.

Agentless system ports for Windows log collection

For agentless collection or remote status access, open the following inbound ports on the destination computers. Each row lists the source and destination so the traffic direction is clear.

Note: The Direction column refers to the firewall rule on the destination computer. If outbound traffic is restricted on the ADAudit Plus server, also allow outbound connections from the ADAudit Plus server to these destination ports.

Port	Protocol	Direction	Source	Destination	Service	Purpose
135	TCP	Inbound	ADAudit Plus server	Monitored computer	RPC	Windows log collection
137	TCP and UDP	Inbound	ADAudit Plus server	Monitored computer	NetBIOS name resolution RPC/named pipes (NP)	Windows log collection
138	UDP	Inbound	ADAudit Plus server	Monitored computer	NetBIOS datagram	Windows log collection
139	TCP	Inbound	ADAudit Plus server	Monitored computer	NetBIOS session RPC/NP	Windows log collection
445	TCP and UDP	Inbound	ADAudit Plus server	Monitored computer	SMB RPC/NP	Windows log collection
49152-65535	TCP	Inbound	ADAudit Plus server	Monitored computer	RPC randomly allocated high TCP ports	Windows log collection

If you use Windows Firewall, you can open dynamic RPC ports 49152-65535 on monitored computers by enabling these inbound rules:

• Remote Event Log Management (NP-In)
• Remote Event Log Management (RPC)
• Remote Event Log Management (RPC-EPMAP)

To enable these rules, open Windows Firewall > Advanced settings > Inbound Rules, right-click each rule, and click Enable Rule.