Troubleshooting

Workstation is not listed in ADAudit Plus

Symptom: The expected workstation does not appear in ADAudit Plus after product-console or bulk configuration.

Resolution:

1. Re-add the workstation from Server Audit > Configured Server(s) > Workstations.
2. Confirm the correct domain is selected.
3. If you used bulk import, confirm servers.csv is in the ADAudit Plus bin folder and saved as UTF-8.
4. Rerun cmdUtil.bat if the bulk import did not complete.

Agent-based collection is not working

Symptom: The workstation is configured, but agent-based collection is not sending expected data.

Resolution:

1. Verify the ADAudit Plus agent is installed on the workstation.
2. Confirm the agent service is running.
3. Confirm the agent can communicate with the ADAudit Plus server.
4. See the deployment, service, and communication requirements.

ADAudit Plus cannot read security events through agentless/status access

Symptom: ADAudit Plus cannot read security events or verify status remotely for a workstation.

Resolution:

1. Review Agentless privileges for workstation and endpoint auditing, especially security log access and Event Log Readers membership.
2. Confirm the Domain Data Collection Account is configured correctly where agentless/status access is used.
3. Confirm the required agentless/status access ports in Data collection, ports, and privilege planning are reachable.

Audit policy status shows not configured

Symptom: ADAudit Plus shows that audit policy is not configured for one or more workstations.

Resolution:

1. Verify <DomainName>_ADAuditPlusWSPolicy and its security filtering.
2. Confirm the target workstation computer account is a member of ADAuditPlusWS.
3. Review gpresult_output.html for the target workstation.
4. Allow Group Policy refresh and replication to complete.

Expected events are missing in Event Viewer

Symptom: Test activity occurs, but matching Security events are not generated on the workstation.

Resolution:

1. Confirm the relevant advanced or legacy audit policy is enabled.
2. Enable the recommended audit policy settings.
3. Force Group Policy update if required.
4. Repeat the test activity and check Event Viewer again.

Events exist in Event Viewer but not in ADAudit Plus

Symptom: Security events are generated on the workstation, but they do not appear in ADAudit Plus reports.

Resolution:

1. Allow time for collection to complete.
2. If agent-based collection is used, verify agent health and communication status.
3. Verify network connectivity between the workstation and the ADAudit Plus server.
4. Confirm Domain Data Collection Account privileges where agentless/status access is used.

Security events are overwritten quickly

Symptom: Reports show gaps, or older security events are no longer available on the workstation.

Resolution:

1. Increase the security log size so it retains at least 12 hours of events.
2. Confirm the retention method is Overwrite events as needed.
3. Review event volume and increase the log size further for high-volume endpoints.

cmdUtil.bat bulk import fails

Symptom: Bulk import does not add the expected workstations.

Resolution:

1. Confirm servers.csv is in the ADAudit Plus bin folder.
2. Confirm the file is saved as UTF-8 and contains one workstation name per line.
3. Use ADAudit Plus administrator credentials when prompted.
4. Rerun the appropriate config server add command.

Frequently asked questions

1. Does workstation auditing require the ADAudit Plus agent?

Workstation auditing commonly uses the ADAudit Plus agent for scalable client-side real-time collection.

2. Are workstations the same as Windows Servers in this guide?

No. This guide is for Windows endpoint computers such as user desktops and laptops.

3. Should I use automatic or manual audit policy configuration?

Use automatic configuration if the data collection identity has the required GPO permissions. Use manual configuration if your organization requires administrators to create and manage GPOs directly.

4. Can I configure more than 1,000 workstations from the product console?

For large batches, use the cmdUtil.bat bulk import workflow described in Add Windows workstations in bulk.

5. Why should the security log retain at least 12 hours of events?

This retention window helps prevent event loss during temporary network issues, high event volume, offline endpoint periods, or collection delays.

6. Can I use a least-privilege account instead of Domain Admin?

Yes. Use Agentless privileges for workstation and endpoint auditing to assign the required rights to the Domain Data Collection Account where agentless/status access or automatic audit policy configuration is used.