In this article:

• Objective

• Prerequisites

• Steps to follow

• Validation and confirmation

• Tips

• Related topics and articles

 Objective   

To set up an alert in ADAudit Plus that automatically notifies administrators whenever an organizational unit (OU) is deleted in Active Directory, helping ensure prompt awareness of critical changes.

 Prerequisites   

• You must have access to the ADAudit Plus UI.

• You must have administrative access or any technician account delegated with permissions to configure an alert for Active Directory.

• Please ensure all the devices or the applicable domain controllers are configured in ADAudit Plus and collecting logs.

 Steps to follow 

1. Log in to the ADAudit Plus web console as an administrator or with a technician account with delegated permissions to create or modify alerts.

2. Navigate to the Alerts tab.

3. In the top-right corner, click New Alert Profile.

4. Enter a relevant Name and Description (e.g., OU Creation Notification).

5. Click the + button next to Report Profiles.

6. In the Select Report Profile window, select OUs Deleted as the report profile.

7. Tailor the Alert Message to suit your specific requirements.

8. Under Advanced Configuration, customize the alerts based on thresholds, business hours, and advanced filtering criteria.

Configure alert notification  

1. In the Alert Actions section, enable the E-mail Notification check box.

2. Enter recipient email addresses.

3. Provide a clear and relevant subject line for the email notification.

4. Select the preferred format for the alert email, either HTML or Plain Text.

5. Use the check boxes to select the details you would like to include in the email:

• Alert Message

• Alert Profile Name

• Event Details

6. Enable the Throttle Notification check box to suppress multiple alerts into a single notification based on defined criteria.
   Example: If multiple logon failures are detected from the same user within 15 minutes, consolidate them into one alert.

7. If SMS provider settings are configured in ADAudit Plus (Admin > General Settings > Server Settings > SMS), enable the SMS Notification check box for real-time updates.

8. Enable the Execute Script check box to trigger a script automatically when a specific alert is generated.
   Example: Lock a user account temporarily after detecting 10 consecutive logon failures from that account.

9. If a ticketing tool is integrated with ADAudit Plus (Admin > Configuration > Ticketing system Integration), enable the Configure Auto Ticketing check box to automatically generate tickets for alerts.

Note: You can also use Throttle Ticket Generation to avoid creating a ticket for every alert and instead generate one for a group of alerts meeting certain conditions.

10. Click Save to activate the alert profile.

 Validation and confirmation 

• Perform a test by creating and then deleting a sample OU in Active Directory.

• Verify that ADAudit Plus generates the alert and that the notification email or SMS is received as configured.

• Check the Alerts tab and related audit reports to confirm the OU deletion event is logged with the correct details.

 Tips 

• Use clear and descriptive names for the alert profile so it’s easy to identify later.

• Consider configuring throttle notifications to avoid multiple alerts if multiple OUs are deleted in a short timeframe.

• Regularly review and update alert recipients to ensure the right personnel are notified of critical changes.

• Combine OU deletion alerts with change reports for comprehensive visibility into Active Directory modifications.

 Related topics and articles 

• How to configure an alert to notify you about new OU creations