Hello,
after enabling "Monitor NTLM Connections" on the firewall I can see connections from the ADAudit Host to Clients using NTLM authentication with the application WMI.

Assuming this message is true: can I persuade ADAudit to use Kerberos authentication?

Regards,
Harald