Odd string in Bad Username report
I am getting several hundred hits a week in the report for the attempt to use the following username: @@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1BAbAUGAyBgOAQFAhBwcAsGA6AweAEDABBwQAIEA4AQNAgDA0AQLAIDA5AARAcDAtAANAQDA4AwMA0CA5AQQAIEACBQLAgDABBwQAkDAyAwMAYDAEBAMAUDA5AgMA0HA Any idea what this is? I don't see how/why malware or a virus would be trying such a large string to brute force access to anything.
Service Stops when Admin logoff from ADAuditPlus Server
ADAuditPlus Service Stops automatically when Admin logoff from ADAuditPlus Server. we areusing SQL 2008 as database and ADAuditPlus version is 4.6.0 4622.
Service account audit
How do you audit your service accounts....such as the least used accounts in a report by the last time the service account was used.
The handle is invalid - Error code 6
I am receiving the following error emails from ADAudit Plus. Subject: "Failure while collecting event log data - ADAudit Plus" Error: "The handle is invalid - Error code 6" Any ideas? Thanks!
How to set up an email alert for exceeding X number of failed login attempts within a given time period?
I am looking to get an email alert when there have been too many failed logon attempts on any given account. For example, occasionally a server has a service that logs in as Administrator, and it will attempt to login a few hundred times in a matter of minutes. Because of this I can't turn on the lock-out policy for the Administrator account. But I'd like to receive a notification immediately after this happens. Can I get an email alert after "Administrator" has over 100 failed login attempts within
ADAudit Plus : Failure while collecting event log data - ADAudit Plus
Hi Friends & Manageengine team members, I need an help on 1 issue. I have not ever worked on ADAudit plus and Now We have an issue with one of our client which I have to handle it. we are getting this below mentioned error from ADaudit for one server : ADAudit Plus Error Error while collecting event log data from Domain Controller : XXX-dc02 Error Details : The remote procedure call failed - Error Code:800706be Common Error Codes and help Can anyone please help me out here as to how to start with
Zip File Attachment
Is there a way to have reports emailed where the attachment is not zipped? Thanks Mike
Zip File Attachments
Is there a way to send reports via email where the attachment is not zipped? Thanks, Mike
GPO Reports, 'Modified By'
Trial is working fantastically well so far. The page for 'Group Policy Settings Changes' and other pages in that category do show all the changes being made to the group policy objects but the columns for Domain Controller and Modified by just appear with a - Does anyone know the cause of this?
Archiving question / suggestion
We have event archiving configured for ADauditPlus at 7 days. Unfortunately, it looks like everything is being written to one file, and that file is either being appended or overwritten. What this means is that if we ever need to go back and re-import data from, say, the week of October 13th, we have to import the entire archive. Why isn't this set up to write archive files on a daily/weekly basis with the date in the filename so that we can import only the dates needed? Also, I believe the documentation
File Shares
Right now I am on the trial version so not sure if this is the issue. I have 2 fileservers and about 7 shares I am trying to monitor. The SACLs configured properly only for about 3 shares on 1 server. I tried to do manually but I keep getting not responding after I setup the first audit so I have to kill it.
2-3 Problems with policy, OU and GPO
hello I have ADaudit Plus running and have configured everything as the docs tells me to. The event-log on all domain-controllers has been setup in size so that they can keep at least two hours og security logs and AD Audit Plus has been setup to query all domain-controllers every 5 minutes. The domain-controllers are 6 Windows Server 2008 R2 and 4 Windows Server 2012 (two with gui and two core). 1. Default Domain Controller Policy is configured as it should be, as everything (and i mean everything)is
ADaudit not synchronizing with AD
How often is ADaudit supposed to synchonize the computer and user accounts with AD? Because ours apparently isn't. When I click on Configuration > Configured Workstations > Add Workstations, I am given a list that includes workstations that no longer exist in AD. This presents a problem when trying to add new systems.
Build 4622 and IE9
I was testing out ADAudit Plus with the eval, and it was Build 4601. We just purchased the software and I went to do a full install with the latest version of 4622. Got it running fine, but when I try and view the 'Reports' tab, a lot of the options aren't showing up on the left anymore (the root options show up, but when I expand them the menu is blank or only partially filled). When I went back to my 4601 test, still fine. I updated the test to 4622, it started doing it, so it's an issue with
Summer time configuration ADAudit Plus
How to set or ajust summer time configuration on ADAudit Plus ?
Error code 2
Newest ADAudit Plus build. Client: Windows 2012 R2 I keep getting: ADAudit Plus Error Error while collecting event log data from : ComputerName Error Details : The system cannot find the file specified - Error Code:2 I don't get this error on a Windows 2008 R2 client.
Error code 2
Latest ADAudit build client: Windows 2012 R2 I keep getting: ADAudit Plus Error Error while collecting event log data from : Computername Error Details : The system cannot find the file specified - Error Code:2 It does not happen with Windows 2008 R2 clients.
Error implementing Object level AD auditing
I went into Reports > OU Management > Recently Deleted OUs and the message "Object level AD auditing needs to be configured for getting proper reports.. " appears. So I click Configure, and I get this: - Error Code:80070005 - Error Code:80070005
Error configuring mail server
We're trying to configure the mail server for ADaudit to send alerts. However, when I try to send a test e-mail I get this error even though the server configured is not localhost: Send Mail Status :Could not connect to SMTP host: localhost, port: 25 This is on a Windows2012 server.
How to create report to find inactive computer accounts?
For example, list all computer accounts that are enabled or disabled, and have not been modified or logged in, in the last 6 months.
ManageEngine ADAudit Plus 4.6.0 Build Number: 4621 Released
Dear All, Greetings from ADAudit Plus! ADAudit Plus latest build 4621 with the addition of Removable Storage Auditing now also for Workstations. Next addition is the page navigation below the reports, alerts and configuration and a few other fixes to enhance your Windows network environment auditing - 'Active Directory, File Servers, Servers, Workstations & NetApp Filers'. With 150+ pre-configured audit & Compliance reports meet the most-needed security, audit and compliance demands. New features,
Session Expiry not working
We have set Session Expiry to 20 minutes under Admin > Connections, however I have come back to my desk after an hour and the session is still active and working.
ADAudit 4.6.0 Build 4611 Release Notes?
Can somebody provide the release notes for build 4611? We've installed the latest build (4611) but are unsure what has been addressed/fixed. The release notes on the update were for build 4610. Thanks! Chris
How to remove AD Audit Plus NTService
How do you uninstall the AD Audit Plus nt service?
Pointing ADaudit to MS SQL server
The instructions in Help in ADaudit say "Please install the corresponding SQL Native Client & Command line Utilities in the ADAudit Plus machine as per the SQL version and CPU type of ADAudit Plus machine." This is for a Remote MS SQL server, so which version are we to use? Also, under that section it says "Note: After clicking on the above Download link, in the Microsoft website, please click on 'Install Instructions' and Download." When we go to Install Instructions, there are over a dozen different
How to view who modified msexchmailboxsecuritydescriptor?
In User Management Reсently Modified User report visible change events Exchange attributes of the user account. 1. Is there a way to see all/any changes Exchange attributes in a separate report? 2. Create alarms to such changes? 3. See the history of changes to Exchange attributes on the user? If the answer to all three questions - "no", then when will it be implemented? We need to understand whether or not to renew the subscription for this product in the next year or buy something else. Best Regards,
Problem with audit file feature with Celerra storage
Hi, I'm in the process of evaluating ADAudit Plus. I mainly need to audit a shared folder available through an EMC VNX5300 storage that emulates a CIFS server. Audit is succesfully enabled on storage and SACLS are set for the share, I can see audit logs through event viewer but File Audit Reports are empty. Is there a way to configure ADAudit Plus to work in this scenario? Best regards, Filippo Durzu
Road Map for ADAudit Plus
Hi there, Is there a roadmap for the product ADAudit Plus for the year 2013-2014 ? Thanks a lot for your time, Regards, Joanès
File shares
I selected a server that has a couple of file shares but when I try to add it via AD AuditPlus it tells me: NO File Shares are available for auditing.
Problems testing the app
Hi everyone. I'have just installed the trial version of adaudit plus and I'm experiencing some problems: I've installed it as a service (using command line as described on http://www.manageengine.com/products/active-directory-audit/help/getting-started/installing-ad-audit-plus.html#Windows Service) The system is not part of the AD (it's an external system) and I'm logged as local admin. After a reboot, the service starts OK and the app seems to work OK, but after some time, the "ManageEngine ADAudit
ADAudit plus to exclude DFS staging folder from auditing
Hi, We have purchased AdAudit plus and taking advantage of its Web-Based Windows File Server Auditing feature. However, like other Windows file replication service (DFS) implementations, We've deployed and configured two-way replication between our 2 file servers for fault tolerance purposes of files. How do we exclude DfsrPrivate\Staging folder and its filetypes from auditing?? This adds unnecessary and numerous amount of data that I do not want to see in file audit reports (shown below). Thanks,
how to exclude DFSR from auditing in ADAudit Plus
Like other DFS implementations, we've deployed and configured two-way replication between our 2 file servers for fault tolerance purposes of files. How do we exclude dfsrprivate staging folder and its filetypes from auditing?? This adds unnecessary and numerous amount of data that I do not want to see in file audit reports.
DFSR exculsion in ADAudit
like other DFS implementations, we've deployed two-way replication for data collection between our file servers for fault tolerance purposes. how do we exclude DFSRprivate folder and its filetypes from auditing? This adds unnecessary and large amount of data that I don not want to see in file audit reports.
ManageEngine ADAudit Plus 4.6.0 Build Number: 4620 Released
Dear All, Greetings from ADAudit Plus! ADAudit Plus latest build 4620, announces addition of two very exciting auditing capabilities - 'Printer Auditing' and 'Removable Storage Files Auditing'. It is now easier than ever to secure & monitor your Windows network environment - 'Active Directory, File Servers, Servers, Workstations & NetApp Filers'. With pre-configured audit & Compliance reports meet the most-needed security, audit and compliance demands. New features, enhancements and fixes in this
Firewall Port for Windows File Audit
Hello, We are trying to setup our windows file shares for auditing but need to know what firewall port needs to be open at the firewall as there is one that exists between our ad audit+ server and the target server.
Installing ADAuditPlus
I am trying to install ADAuditPlus on a Windows 2008 R2 Domain Controller. I am getting "A referral was returned from the server" error, with no other info. There is nothing in the logs regarding the install. This error pops up as soon as I click on the EXE. It is a brand new AD install, with a fresh install of 2008 R2 server.
GPO refresh triggers ADAudit event?
Populating local administrators Group on servers with Group policy preferences. After a while ADaudit triggers alarms "Member '-' was removed from Domain Local Security Group 'Administrators' by 'DOMAIN\SWE-FS1$'." and directly after "Member '-' was added to Domain Local Security Group 'Administrators' by 'DOMAIN\SWE-FS1$'." This start after a while on some servers. The only way I can get it to stop is to remove the server from ADAudit or remove the GPO. HOw can I solve this issue? I stil want
Please help.
Hi... How to find out the Who has deleted(From Which IP Address) user from Active directory by using AD Audit plus.
File Share Auditing Windows 2003 Cluster
We have a Windows 2003 Cluster with 4 file shares on it, the cluster does not show up in options for monitoring of file shares, but the member servers do show up. I added the primary server that currently has the shares in ADAudit and added one of the shares to test it out. The SACL was not applied Windows Error Code 11111. I added the SACL manually via the instructions. After that I clicked run now and after a few seconds I refresh under status it says troubleshoot. I followed all of the steps
What are the benefits for linking ADAudit Plus and ADManager Plus?
What are the benefits for linking ADAudit Plus and ADManager Plus? I've checked the help file but cannot see an answer for this
Next Page