ManageEngine Shield NxG 2026 – India Roadshow
Hello, Cyber threats are evolving rapidly, and organizations need to strengthen their security posture across identities and critical IT environments. We’re pleased to invite you to ManageEngine Shield NxG 2026 – India Edition, an exclusive event bringing
Join Us for ManagEngine Shield NxG 2026 – Chicago, Miami, San Francisco & Dallas
Hello there, Cyber threats are evolving. Is your organization ready for what’s next? Join us at ManageEngine Shield NxG 2026 – USA Edition, where IT and cybersecurity leaders will explore practical strategies to strengthen identity security, threat detection,
ADAudit Plus – LOCAL SERVICE intenta leer archivos
Hola, Tengo un problema en ADAudit Plus. En uno de los reportes aparece repetidamente el usuario LOCAL SERVICE intentando leer archivos, pero todas las operaciones están fallando. Como se puede observar en el reporte: Usuario: local service Total de eventos:
Problems updating Windows on the server with ADAdit
Hi, we're having trouble updating Windows on the server with ADAdit. Every time we try, it stops at around 4% and gives the error "Windows server installation has failed." Could this be due to some ADAudit security restriction? Thanks.
Feature request - Display Name in Default Report Charts
In the default Logon Failures report, the chart currently displays the user's sAMAccountName as the username. For example, an AD account with: sAMAccountName: v12345 Display Name: Nguyen Van A is displayed as v12345 on the chart. We would like to have
[Live Webinar] Are Misconfigurations Putting Your Environment at Risk?
Hi, Misconfigurations across cloud environments and servers can quietly create security gaps, increase exposure, and make it harder for security teams to maintain a strong risk posture. Join us for an upcoming webinar where we’ll explore how auditing
ADAuditPlus - v8700 - Cloud Directory - API Permissions
Hello everyone, I've updates ADAuditPlus to v8702. After the update I checked the data sources and saw that the date source in Cloud Directory was extended. Before the update we had Audit, Sign-In, Risk-Detection and Intune. Now new areas were added -
Can't upgrade ADAudit+ from Build 8701 to 8702
When I try to upgrade from Build 8701 to 8702, I always get the following message: I've started and stopped the program multiple times but I keep getting the same error. I've rebooted the server several times with no change. How do I get past this?
(Seminar)[ManageEngine] Shield NxG 2026 | What recent cyberattacks are teaching us
Hello, It's been a while since we last connected, and we're excited to share that we'll be in the nearest city. We're bringing together security and IT leaders for a focused discussion on one of today's most pressing challenges: identity security. As
ADAudit Plus Service Unable to stay running
I have a ticket open but wanted to reach out here as I am not getting any feedback on the ticket so far today. I have already uploaded the logs to the support team but wanted to ask about a few things I've found as I've been parsing through the logs.
Log4j CVE-2026-34478
Hi, ADAudit Plus uses Log4j 2.25.3 and is vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2026-34478 Are there plans to fix this in the next update?
gMSA Account for ADAuditPlus AD Auditing?
I don't see specific mention of group managed service accounts being supported here https://www.manageengine.com/products/active-directory-audit/help/quickstart/privileges-required-for-ad-windows-server-workstation-audit.html are they please?
Allow customization / editing of Attack Surface Analyzer (ASA) alert settings
Currently, all alerts generated by the Attack Surface Analyzer (ASA) are fully predefined and cannot be customized. Unlike standard ADAudit Plus alert profiles, there is no way to: Suppress false positives for specific accounts, computers, or OUs (e.g.
Nasuni NAS
I saw another post about Nasuni being on the roadmap for 2022. Just was wondering if that was still in the works. Nasuni is our primary NAS and would love to add it to ADAudit.
ADAuditPlus how to backup and restore ms sql database
Hi, how can I restore the adaudit plus configuration if the database is running on an MS SQL Server? I switched the service to a service account, and after that, the configuration was gone. The restore method described in the instructions didn't work
Disabled Users Logon Attempt alerts coming through - but user doesn't exist
Hi there I have an alert setup for when a disabled user account attempts to log in Today I'm getting alerts suggesting a particular user is attempting to log in, but when I search in AD, there is no trace of that user. Anyone any ideas why this might
ADAudit Plus fails to send logs to Splunk HEC — SSLHandshakeException PKIX path building failed with self-signed cert
Hi everyone, I’m trying to forward logs from ManageEngine ADAudit Plus to a Splunk HTTP Event Collector (HEC) over HTTPS. On the Splunk side, HEC is configured with a self-signed certificate. When ADAudit attempts to send data to HEC, I get the following
NTLM for authentication - Report
Hi My I know if "Ad Audit" have features or report to show me, How can I find out if my clients are using NTLM for authentication instead of Kerberos against specific Windows servers, applications, or services Find the machine/application/services using NTLM for authentication ? That will show me in the report
Unusual Activity -Logon Time on Host - reset
I have Ad Audit Plus that audit my Domain Controllers activity. I install new domain controller server and give a name like an old server that i remove years ago. The new server is use for ActiveSync so he has activity all time. Sinc I install it I get
ADAudit and Netapp ONTAPI (ZAPI) EOL.
NetApp are in the process of phasing out their old ONTAPI (ZAPI). ONTAP 9.13.1 software will be the final version to offer normal support of ONTAPI. ONTAPI access re-enablement will not be supported on ONTAP 9.18.1 As ADAudit uses ZAPI (We do need to
An issue eith export of empty report
Hi, AdAudit Plus Build 8530 (Oct 09, 2025) PGSQL 10.x Since we make update from build 8512 to 8520 we observe below issue: The report shared with local administrators doesn't display correctly. Technician A - has access to selected OUs. After logging
ManageEngine patch 8600 triggers virus detection
I was trying to install Update 8600 on ME Ad Audit and it triggered a virus detection: ran C:\Windows\explorer.exe, which attempted to access C:\temp\ManageEngine_ADAudit_Plus_8_6_0_SP-0_0_0.ppm\RemCom.exe\000d1fc0.EXE. The Trojan named GenericRXAA-AA!C961541A4D23
Netapp REST API integration
Hi, We have configured our Netapp filer for file auditing, but ME ADAudit Plus is still using the old ZAPI access to the filer. When are you going to implement the new REST API? As far as I know, Netapp is removing ZAPI access to the filer in a few updates
Duo Root Certificate Authority Bundle Replacement
Hi all, We utilize Duo for MFA for our ADAudit Plus. We are already configured for Web SDK v4 within our installation, but I keep getting alerts within Duo that the integration is not supported. Is anyone else running into this issue?
AD Audit Plus and NAT Communicaton
Has anyone been successful in setting up the NAT configuration between AD Audit Plus and another public facing server? We use Endpoint Central for all our deployments and it uses its own NAT through a secure gateway to communicate to our remote devices.
Feature request: Attack Surface Analyzer / Kerberoasting add column "Target Object Name"
please add the "Target Object Name" to the Columns which you can see in the threat details. It is important to see, which of the targets were used. Under thread evidence it is named as "requested service". And it would be very helpful to be able to generate
AdAudit API
Is there any API for AdAudit plus ?
Inquiry about creating custom reports by folder in ADAudit Plu
We currently have a File Server whose structure is organized by main folders (see attached image), and each of these folders is associated with a security group created in our Active Directory (see attached image of the groups). Access to these folders
AD Audit Account Analyzer showing just WORKSTATION
Dear Team, Facing one challenge of account lock out for one user, on checking analyzer in CALL MACHINE NAME column only showing WORKSTATION not actual hostname, why it is like this? Any answers CALLER MACHINE NAME showing just WORKSTATION in AD Audit
Azure Auditing - initial sync - too many requests, token expiry
Just setting up an ADAudit Plus poc and have hit a bit of an experience-dampener with the Azure auditing. It appears the initial audit log sync keeps hitting some request limit. Official advice was to keep rotating the app registration secret and re-entering
Execute script from AD Audit Alert
Let’s see if you can help me, please. I want to know the steps to follow to run a script when a user changes their password outside of their working hours. The script will connect to AD and block the user.
Audit Policy Status - change "REQUIRED" parameters from "not required" to "success"
I am attaching a screenshot from "view RSOP data", as I understand it, the first column is the setting on the domain side, and the second is the setting on the side ADaudit. How to change "REQUIRED" parameters from "not required" to "success"?
DCSync
Hi, Is there a way to exclude the msol_user account from being reported in the DCSync attack events? As I understand it, the msol account is designed for this?
java.exe 100% cpu consumption
Is anyone else noticing this issue recently? We are seeing java.exe for ADAudit consistently consume 100% CPU, and ADAudit itself stops functioning with any data gathering/alerts/notifications. We are having to either kill java.exe and restart the service,
User-specific file server audit report created in AD
I have the audit service installed on the file server, my users created on the active AD server have access to certain specific folders but my ADAudit plus sends me a general dashboard how could I have a report of a specific user that created, modified,
CIS Benchmark
Hi. When CIS Benchmarks for Windows version 4 will be added ?
Remcom.exe flagged as malicious
Hi, Just tried to upgrade from 8.5.0.0 to 8.5.1.0 and our virusscanner (McAfee) is intercepting the remcom.exe file in the upgrade ppm-file as it thinks it is malicious (Windows Remote Installer). Same problem as described in https://pitstop.manageengine.com/portal/en/community/topic/remcom-exe-flagged-as-malicious.
ADAudit plus member servers list auto refreshes every few seconds.
Hello, I'm attempting to manage member servers, but the list auto-refreshes so quickly I can't scroll down through the list. By the time I get to the server I'm looking for it shoots me right back up to the top of the list. Is there a setting for this
ADAudir Send alert to telegram
hi, i tried configured ADAudit send report to telegram, i configured sms setting as API TG but settings not Save - "Enter valid HTTP URL.". how can i make ADAudit use Telegram for alerts
How do I create a custom password reset report in AD?
I have ADAudit Plus associated with my active directory in Windows Server 2022, but I need to create a custom report of users who have reset network accounts within a specific time interval. Could you guide me on how to create the custom report? I have
Next Page
