Can access Audit Dashboard even though Windows Service is not running
We updated our AuditPlus to 7060 from 7000s After updating, i am able to access the web page of audit plus even though the Audit Plus windows service is not running. When i try to run the window service, it wont let me, it just goes back to stopped status.
Why is the DataEngine Xnode service / modules folder housed on the install folder?
"Program Files\ManageEngine\ADAudit Plus\apps\dataengine-xnode" I get that this feature is to reduce search times but why can't a lot of these audit logs located in the below folder to go MSSQL? Program Files\ManageEngine\ADAudit Plus\apps\dataengine-xnode\data\main\audit-log
Does ADAdut Plus support IBM V7000 SAN auditing?
We use an IBM V7000 as one of our file servers. It's a SAN but I don't see an way to add it for file auditing.
Reverse Proxy with Let's Encrypt
Hi, I've created a reverse proxy server to handle SSL certs on the front end for ADAudit Plus. However, there seems to be a browser issue with Chrome and Brave and Edge, where I get this error: If I use Firefox, the site loads fine. I'm using Nginx
ADAudit Plus - User name encoding error
We have been using ADAudit Plus for nearly a year, and receive daily summary emails that detail logon activity. I have seen sporadic issues with user names present in this report, maybe once every other month. The issue appears to be some kind of encoding/decoding
"ADAudit Plus is not running" after migrating to new server
Hi! We recently migrated ADaudit to another server following the guide. And it is working fine. But after the migration we are getting e-mail that "ADAudit Plus is not running" and the URL is pointing to our old server. Email looks like this. And I can´t
ADAudit is not capturing event ID 4769
Hello, I am looking in Profile Based Reports -> Account Logon - All Users Logon and this report does not capture even ID 4769 (Kerberos service ticket has been requested). This does not make sense as I see the events in the Security Log on my domain controllers,
data is not sent in real time
I tried to reinstall my ADAudit Plus version but everything is not fixed, time of last event is always updating slower than last event read even though realtime is set, gradually time of last event will no longer update again. I have to restart ADAudit
Account Lockout Analyzer - Can Only See Source
Hello, I can only see the source of lockouts under Account Lockout Analyzer. Is there a guide that can help me find the RCA of why an account keeps getting locked out on a specific server?
Unable to create an alert that triggers if something is renamed in an OU
Hello all, I'm trying to create an alert that is triggered if someone renames a group in an OU. We have checked and the auditing is turned on for add/remove OU objects on the entire domain, so I don't think that's the issue. My current settings for the
How do I create a new Report Profile
Hello, I can't figure out how to create a new Report Profile so I can link my custom action. I'm following the guide here: https://www.manageengine.com/products/active-directory-audit/help/configuration/report-profile-categories.html There is no such
Set event log collection schedule
Hello! I have a question and I can't find in the documentation how to solve it. On weekends my inbox fills with emails stating that most workstations cannot be contacted: "Failure while collecting event log data - ADAudit Plus." I have already established
[CVE-2022-28219] Unauthenticated Remote Code Execution Vulnerability - ManageEngine ADAudit Plus
Severity: Critical CVEID: CVE-2022-28219 Affected Software Version(s): All ADAudit Plus builds below 7060 Fixed Version(s): Build 7060 Fixed on: 30th March, 2022 Details: ManageEngine ADAudit Plus had vulnerable endpoints that allowed an unauthenticated
[CVE-2022-24978] Privilege Escalation Vulnerability - ManageEngine ADAudit Plus
Severity: High CVEID: CVE-2022-24978 Affected Software Version(s): Build 7054 and below Fixed Version: Build 7055 Fixed on: 8th March, 2022 Details: CVE-2022-24978 refers to a vulnerability that allows a low privileged user to access the plain text password
Schedule Report Ideas?
Hello, Anyone have any suggestions on some scheduled reports I could send to the help desk for being proactive on lockouts or similar subjects? If so, what are the types of thresholds you set? Thanks
There are No Printers Available in the Selected Server
When adding a print server i am getting this error . Is ther any solution for this.
Remote Desktop Disconnected users report
I have ADAudit Plus, and I am trying to get a report of the people who refuse to log out and simply disconnect. I need a way to report on this. According to the website I should be able to do it, but I cannot find it in the software.
Database data missing after AD Audit Plus patch
Hello. After update to latest Version:7.0.5 Build:7054, all previous data is missing for Active Directory Reports However, all Azure AD data is available: How can I check if the AD data is still in the database and recover it?
Code Signing Certificate for AuditPlus version 7051
So version 7051 of Audit Plus is asking for a certificate to be downloaded as per Download ADAudit Plus Service Pack and enjoy the new product with added audit features (manageengine.com). This seems to be a code signing certificate but our Windows systems
ADAudit archiving and MS SQL
Hello everyone. I need some advice with our situation:we have ADAudit running for a few years now,and have archiving enabled.The archiving works, the archive files get created on the destination folder, but as far as I can tell, none of the data gets
Recently locked out report - reporting unknown machine and IP
Hi, I keep seeing the local administrator account on 1 of our DCs getting locked out, event # 4740 but it reports the caller machine name as B_104 and the caller IP address as B_104 (policy is set to unlock after 5 minutes)... the next lockout will have
Password Never Expire - alert
So, I just installed Log360 with ADAudit Plus. I am receiving an email alert with the subject 'Password Never Expire Enabled'. The email contains the following information - User account 'JSmith' was changed by 'NT AUTHORITY\ANONYMOUS LOGON'. Changed
How to report Kerberos-Logon activities from trusted Domain?
I tired a couple of approaches but did not catch Events from User-Logons from a trusted Domain. Typically it is Event ID 4624: ================================================================= An account was successfully logged on. Subject: Security ID:
Report for several accounts
I want create a script that shows logon data for all my service accounts, 100+ accounts. This is to satisfy an audit requirement and assist in identifying where these accounts are used How can I create this report? Do I need to access the DB directl
Xnode Usage and Data
What exactly is stored in the folder <installdir\\ManageEngine\ADAudit Plus\apps\dataengine-xnode\data\main. This folder is now larger than my MSSQL DB that hosts Auditplus 7051. My DB is 80 GB but this folder is 100 GB. I'm wondering what AuditPlus uses
remcom.exe crashes
greetings remcom.exe crashes all the time and makes Adaudit service halted. Error details attached. OS and hardware details: windows server 2019 48 GB RAM 24 virtual core CPU any help is appreciated!
java array size exceeds
Hi adaudit service stops after 5 times resetting and facing this error in every 5 minute: java.lang.outofmemoryerror: requested array size exceeds VM limit This problem happend after I just upgrade to 7050 I have changed the heap size to (wrapper.conf):
Trying to get rid of Kerberos UNconstrained delegation
We have some computer accounts that have Kerberos UNconstrained delegation configured and want to switch to Kerberos constrained delegation. However to do this we need to know which services these accounts are requesting a ticket for in the backend (ex. MSSQLSvc/SQLSRV01:8080).
File Audit: Default File audit Rules
Can I change the audit rules for files and folders that are assigned through the web interface when a folder is added to audit (Method "Automatic")? For example, I need to add action "List directory, read data" to an audit rule for folders, since folder
SIEM Integration
Hi All, ADAudit Plus has now been powered with 'SIEM Integration'. This feature has fused ADAudit Plus into a large unit of SIEM and the option allows you to forward data from ADAudit Plus to a syslog server/Splunk. Please refer below link to configure ADAudit Plus to support SIEM log forwarding. https://www.manageengine.com/products/active-directory-audit/help/getting-started/siem-integration.html Regards, Bruce ADAudit Plus Team
Log4j AD Audit Plus CVE-2021-44228
Hi, i found Log4j-* in /ManageEngine/ADAuditPlus/apps/dataengine-xnode/lib Is there any fix or workaround?
Remove custom report from the dashboard?
Is there a way to remove custom reports from the "Reports" Dashboard? I cannot seem to find a way in the documentation/forums. Per the picture below I'd like to remove these old reports (highlighted in yellow) that people have created over the years.
ADAudit Plus 2021 feature highlights
Over the past year, we have steadily added new features and enhancements to ADAudit Plus. We have also fixed issues to provide a seamless experience to our users. While there are many significant feature additions, here are 12 new benefits of using
Unable to search Archived files from the portal (they are located in the directory)
Hello, I want to search for recently disabled users for the last 3 months. it shows me up to the oldest log of July, 2021 And also shows me a list of .zip archived file located in the local folder. How do I make it search within the zip archived files
Fix released for a vulnerability in ManageEngine ADAudit Plus
An unauthorized arbitrary file write vulnerability (CVE-2021-42847) in ManageEngine ADAudit Plus, has been addressed recently. This post explains the vulnerability and the steps to fix it. What is the issue? The vulnerability in ADAudit Plus lets
The "ManageEngine ADAudit Plus" service is not running
The "ManageEngine ADAudit Plus" service is not running after adding dedicated service account to Log On As tab with the required permissions in order to avoid using Domain Admin account.
Customizing summary reports
Hi. As the title says - is it possible to customize the daily summary report been sent by mail? We're looking to change the font sizes, adding links to the appropriate reports in the system, even splitting to multiple reports incase of multiple domains. Thanks in advance Shlomi
Report for source subnet
Hello community, I'm looking for following report: I want to see the amount of successful logins per subnet. I can see the client ip and username of all successful logins, so the information is basically ready. so for example: User A - Client IP 192.168.10.10
Logon failures not audited
All, I have installed AD Audit Plus and set my DC's and my file server up for auditing. The audit policies for both in the portal were successfully applied and I have checked the policies vs. the official KB's just to be sure as wel as a reboot of the
How to audit administrative shares?
How to audit administrative shares when accessed via UNC? Ex: \\servername\d$ Any way to track using file audit?
Next Page