We have started receiving hundreds of alter emails stating the following. They list many different servers. I wanted to understand why these are happening and how I fix it. I am confused as to why ADAudit is collecting event logs from our servers when it's configured to pull from domain controllers.

ADAudit Plus Error

I have done the following troubleshooting....

Ran wbemtest and connected successfully to domain controller.

AdvFirewall is OFF on domain controller.

Was able to connect to domain controller using event viewer on AD Audit Plus server.

Thanks for any help or guidance,

Rob.