In this article:

• Objective

• Prerequisites

• Steps to follow

• Validation and confirmation

• Tips

• Related topics and articles

Objective  

Learn with step-by-step instructions how to set up an alert in ADAudit Plus that notifies administrators when a user’s password is reset to ensure account security and enable timely response to unauthorized changes.

Prerequisites  

• You need access to the ADAudit Plus UI.

• You need the admin role or any technician account delegated with permissions to configure an alert.

• Please ensure all the domain controllers are configured in ADAudit Plus and are collecting logs.

Steps to follow

1. Open the ADAudit Plus web console.

2. Use a technician account with admin privileges or any account with delegated permission to configure alerts.

3. Navigate to the Alert tab from the top menu.

4. Click + New Alert Profile.

5. Provide a meaningful Alert Name (e.g., User Password Reset Notification).

6. Add a clear Description to specify the intent of the alert.

7. Under Report Profiles, choose your on-premises domain.

8. From the report list, select Password Reset Users.

9. Under Advanced Configuration, customize the alerts based on thresholds, business hours, and advanced filtering criteria.

10. In the Alert Actions section, check the Email Notification box.

11. Enter recipient email addresses.

12. Provide a clear and relevant subject line for the email notification.

13. Select the preferred format for the alert email, either HTML or Plain Text.

14. Use the check boxes to select the details you would like to include in the email:

1. Alert Message

2. Alert Profile Name

3. Event Details

15. Check the Throttle Notification box to suppress multiple alerts into a single notification based on defined criteria.
    Example: If multiple logon failures are detected from the same user within 15 minutes, consolidate them into one alert.

16. If SMS provider settings are configured in ADAudit Plus (Admin > General Settings > Server Settings > SMS), check the SMS Notification box for real-time updates.

17. Check the Execute Script box to trigger a script automatically when a specific alert is generated.
    Example: Lock a user account temporarily after detecting 10 consecutive logon failures from that account.

18. If a ticketing tool is integrated with ADAudit Plus (Admin > Configuration > Ticketing System Integration), check the Configure Auto Ticketing box to automatically generate tickets for alerts.

Note: You can also use Throttle Ticket Generation to avoid creating a ticket for every alert and instead generate one for a group of alerts meeting certain conditions.

19. Click Save to activate the alert profile.

Validation and confirmation

• Manually reset a user's password using Active Directory Users and Computers (ADUC).

• Go to the Alerts tab and check if the alert was triggered.

• Verify that the email notification was received by the intended recipients.

Tips

• Create alert profiles with clear naming conventions to identify them during audits easily.

• Use filters to monitor password resets for specific privileged or high-risk accounts only.

• Always validate alert configurations in a test environment before deploying to production.

Related topics and articles

• How to configure an alert to notify when a password is changed for a user