Remcom.exe flagged as malicious
Hi, Just tried to upgrade from 8.5.0.0 to 8.5.1.0 and our virusscanner (McAfee) is intercepting the remcom.exe file in the upgrade ppm-file as it thinks it is malicious (Windows Remote Installer). Same problem as described in https://pitstop.manageengine.com/portal/en/community/topic/remcom-exe-flagged-as-malicious.
CPU Utilization Extremely High
CPU utilization is at 100% majority of the time. AD Audit seems to be at a standstill - takes forever to bring up the login page and not even updating the reports. Running 4 Procs and 8GB RAM
Technician no longer
I have two technicians that are no longer visible in the Technician list after I deleted a Role that they were a member of. If I attempt to add the accounts back I receive a message that the user account already exists. I need to figure out how to get the user accounts back in the list so I can add them to a different role. Thank you.
Query Exception Occurred in background Database Issue
Hi, Could you please advise i want to load archived data to generate a report for last 6 months ago but i cannot i got the error below: Query Exception Occurred in background Database Issue
ADAudit: How to alert on a server reboot ?
Need to know when a server is rebooted or shutdown. How do I set this up for a specific server?
Getting errors when data are collected
Hello, We puchased AD AuditPlus, it is installed on Windows 2003 R2 x64 server, volume to store data is 350 GB, 300 GB available for use. AD Audit Plus is version 4.1 build 4110. We have around 64 DCs that we are auditing. I'm getting an error : Not enough storage is avialable to process this command - Code error : 8 What does it mean ?, how can I resolve it ? In admin/Domain Settings, it seems that time for last event read time is not correctly updated and message still visible Event collection
Failure while collecting event log data - ADAudit Plus
Dispite disabling a domain controller under domain settings i still get "Failure while collecting event log data - ADAudit Plus" notifications
ADAudit is not capturing event ID 4769
Hello, tell me how the problem was solved when events 4769 do not fall into the database? Events on domain controllers are present, the settings are similar to the topic: https://pitstop.manageengine.com/portal/en/community/topic/adaudit-is-not-capturing-event-id-4769
ADFS audit stopped working after 6050 upgrade
Hi I updated from 6032 to 6050 and now we receive no ADFS audit info. Is it some known problem with ADFS audit in 6050?
AD Audit Account Analyzer showing just WORKSTATION
Dear Team, Facing one challenge of account lock out for one user, on checking analyzer in CALL MACHINE NAME column only showing WORKSTATION not actual hostname, why it is like this? Any answers CALLER MACHINE NAME showing just WORKSTATION in AD Audit
Disabled User Login Alert
Whenever a user account that has been disabled is re-enabled and moved to the appropriate OU, that account still seems to be flagged as disabled in ADAudit as it will continue to send out alerts every time that user logs into a computer. This only seems to happen on accounts that were previously flagged as disabled.
Java.exe Hight CPU usage
Hi ALL I detected hight CPU usage by Java.exe ( Zulu Platform x64 Architecture) at latest several days Version:7.2.0 Build:7201 Anybody have similar situation ??
Apache Commons Text 1.5.x < 1.10.0 Remote Code Execution (CVE-2022-42889)
It appears that ADAudit+ is possibly vulnerable to CApache Commons Text 1.5.x < 1.10.0 Remote Code Execution (CVE-2022-42889) in its current release, I have not validated this beyond our vulnerability detection software (Tenable.io). Can you please validate
There are No Printers Available in the Selected Server
Hi there! We encountered a problem while auditing print jobs. Unable to add a print server to the program: "There Are No Printers Available in The Selected Server". On the server close to the twenty printers. Audit policy is included at the domain level.
Why are AD Audit Plus support tickets automatically closed?
I have entered 2 support tickets for AD Audit Plus and they were both immediately closed.
AD Audit Plus CVE-2025-24813 Tomcat
Hello, I created a ticket for this CVE-2025-24813 vulnerability but it was closed. Is there an ETA for a release of ADAudit Plus that will include the patched tomcat version for this CVE?
Multiple events for a single event
Looking through the reports we are noticing the graphs and results are inflated because they are counting a single event as multiple events. For example, say a user gets locked out, we have 3 domain controllers so a single user unlockout event is getting counted as the user getting locked out 3 times instead of just once. likewise the workstation will also report the lockout so we get a workstation user event, a domain controller event(s) all couting as multiple events even though its a single instance.
ev_temp problems again
Hi, I updated to build 4134 last week and I'm starting to see a build up of files in the ev_temp folder again, and we are not receiving some of our reports via email. One report did work but didn't show logins for half of the day. Any ideas or is there another update? Thanks Jeff
Schedule Report
Hi, When I create schedule report for audit logs, Its giving below error.. I already check mail settings its works and I check the directory of file The first screen about "cannot find file" C:\Program Files (x86)\ManageEngine\ADAudit Plus\webapps\adap\schedule-reports\belbim.local\adbelbimlog\Jan192012\10-05-AM\Renamed\Moved_Users_in_belbim.local.html (The system cannot find the path specified) Any suggestions ? Is it about folder permission ? Also I tried change permissions to "everyone read/write"
"Message from webpage" error saying "Need physical access to the machine where ADAudit Plus is running"
*Sorry if double post - posted earlier - did not see it in the forums. Running Audit Plus 4.1 Build 4110 (was happening with build 4101also) When clicking on "View Reports" link in Reports Scheduler, it will not display reports - returns a "Message from webpage" error saying "Need physical access to the machine where ADAudit Plus is running", and will not display report. INFORMATION: ADAuditPlus running as a service. Server Info: Windows 2003 SP2 Standard Edition - VMware virtual server 2.40GHz
AD Audit Plus Build 4530 Upgrade Issue
After upgrading to AD Audit Plus Build 4530 I recieve this error when trying to modify anything in the computer lists. [Exception in:/jsp/audit/configuration/ComputersList.jsp] null Does anyone have any idea? I believe I upgraded from build 4510 Aside from trying to modify the computer lists everything else appears to be working as expected.
"Could not allocate space for object 'dbo.Schedule_Audit'. 'Schedule_Audit_PK' in database 'ADAIDOT' because the "PRi
"Could not allocate space for object 'dbo.Schedule_Audit'. 'Schedule_Audit_PK' in database 'ADAIDOT' because the "PRIMARY" filegroup is full Had this issue and discovered SQL Logs were full due to how a report was setup to gather information. Now I can't the service ManageEngine ADAudit Plus to stay started. Event Log - The ManageEngine ADAudit Plus service terminated with service-specific error %%-1. The Warning before that is TCP/IP failed to establish an outgoing connection because the selected
no data available in report
Most of the reports I scheduled contained no data. After I turned on debug logging I found out why: the reports were too big te send by email. Part of the logfile: SYSOUT]|[INFO]|[17]|: javax.mail.MessagingException: 552 5.3.4 Message size exceeds fixed maximum message size After I disabled sending the reports by mail it worked OK and the reports contained data. It is weird that because it could not send the reports by mail, it didn't make the reports at all.
Loading the Chart...
For some reason I lost all the charts in ADAuditPlus. Currently I have it running on my work station because it's a trail version. Is it possible to reset something in order to get the charts back? Thanks!
no data Available
Hello, I use Trilal Version 4.0.0 build 4043. I have one DC 2003 and two 2008 R2. Data from the 2003 DC receives normal,but no date from 2008 DC....I did everything that was here in the forum described, but unfortunately the result did not change. Our company plans to buy the program, but before buying I would like to make sure that everything works.
Unable to create an alert that triggers if something is renamed in an OU
Hello all, I'm trying to create an alert that is triggered if someone renames a group in an OU. We have checked and the auditing is turned on for add/remove OU objects on the entire domain, so I don't think that's the issue. My current settings for the
Advanced GPO problem
Hello, We have ADAudit plus latest version installed on DC directly, and the OS is Windows server 2012 R2. The problem is that the advanced GPO report categories is not appears any report about changes that happened in the policies, exept for "Extended Attribute Changes for GPOs" report and "Group Policy Permission Changes"report. Appreciate your helps.
Disabling SMBv1 breaks ADAudit
I've disabled SMBv1 on my domain to mitigate the security vulnerabilities associated with it, and now ADAudit is showing "Error - The RPC server is unavailable: Error Code:6ba" for my domain controllers. ServiceDesk Plus had this same issue, but was fixed in version 9310 (SD-65898: Single Sign on does not work if we disable SMBv1 protocol in domain controller.) Is there a hotfix for this on ADAudit?
Text errors in email notifications in latest update
Some errors in email alerts. When unchecking show profile name, the email subject still has a colon (:) in the beginning of the subject line. Also, %CALLER_USER_NAME% now contains the domain name in front with no slash (ex. "DOMAINusername") in both email subject line and message text. Please remove, or add the option to remove the domain name. And the computer name has the trailing $ in the email subject and message text (ex. "DESKTOP$"). Not needed for email alerts.
Alert don't return the source user
Hi @all, Since some times (i don't know how much), when someone from my network modify the default domain policy GPO, i get this message : GPO Default Domain Policy was modified by at 11/10/2019 11:06:29. Which is great but the username is missing after "by". What should i check to resolve this issue ? Thanks a lot. Regards,
File Audit - Dashboards stop showing/refreshing data
Although I can see under the Alerts and Event Logs that File Audits are being processed and registered, when going to the *File Audit tab it shows old data events. It seems it stops refreshing the dashboards at some time. Quick workaround is I have to restart the AdAuditplus service and it starts showing updated File Audit data/events. I'm unable to find an error or significant event under Event logs of the server but can't find any. How can I fix this without having to restart the service every
Schedule Report Error
Hello Team, I can access the report for Domain Users from last month when I run it manually. However I got "Error - Error during previous run" under Last Schedule Status when I try to schedule the report. It was scheduled as Every month on day 1 at 12:01
Migration of AD Audit to a new server failed. Looks to be due to SQL Native Client not been recognised
Hi, I've recently tried to migrate our AD Audit Plus server from 2008 to a 2019 windows standard server. This points to a remote Windows SQL 2012 database instance. It hasn't been able to write data back to the database. As we've got a backup of the migrated
java array size exceeds
Hi adaudit service stops after 5 times resetting and facing this error in every 5 minute: java.lang.outofmemoryerror: requested array size exceeds VM limit This problem happend after I just upgrade to 7050 I have changed the heap size to (wrapper.conf):
Service keeps restarting
When ever I select run now from the Domain Settings screen, the service stops. Then it starts itself again. This only happens when I hit run now for one particular DC. The other one works fine. They are both Win 2003 SP 2. The one that causes the issue is local. The one that doesnt is remote. Before I purchase the product, I hope you can resolve this issue for me. I have purchased 5 different ME products. Thanks
ADAudit Plus - User name encoding error
We have been using ADAudit Plus for nearly a year, and receive daily summary emails that detail logon activity. I have seen sporadic issues with user names present in this report, maybe once every other month. The issue appears to be some kind of encoding/decoding
Audit policy Information is inconsistent
In AD Audit you have the ability to check the Audit Policy Status. (https://adaudit.server.internal/#/admin/rsop) This indicates what is required. If you follow the link on a report to troubleshoot missing data you get taken to the help files where a
ADAudit plus member servers list auto refreshes every few seconds.
Hello, I'm attempting to manage member servers, but the list auto-refreshes so quickly I can't scroll down through the list. By the time I get to the server I'm looking for it shoots me right back up to the top of the list. Is there a setting for this
Error install Service Pack
I am trying to install service pack 7_2_0_SP-6_0_0 we are currently running 7.2.0, Build 7212. Whenever I do the update I get the error message "Please start the product, then stop it, and then apply the service pack" I have done this several times but
NTLM authentication logs
Good afternoon. I want to enable NTLM authentication logging in ADAudit v8.0.0.8003. But I can’t find this parameter where it was before. Tell me, where is this enabled now?
Next Page