In this article:  

• Issue description

• Prerequisites

• Possible causes

• Resolution

• How to reach support

• Related topics and articles

Issue description  

Reports in ADAudit Plus are showing activities that users claim did not occur. For example, a report may show that a security technician made changes to other user accounts, but the technician denies performing these actions.

Prerequisites  

• You must have access to the ADAudit Plus web console.

• You need administrator access to the relevant domain controller to view event logs.

Possible causes  

ADAudit Plus does not generate or modify any event data on its own. It collects and displays information directly from the security event logs generated by the domain controllers. The presence of an activity in a report indicates that a corresponding event was recorded in the Windows security log on the source domain controller.

Resolution  

Follow these steps to trace an activity from an ADAudit Plus report back to its original source event on the domain controller.

Step 1: Find the event record number in ADAudit Plus  

1. Open the relevant report in ADAudit Plus.

2. Click the Add/Remove Columns option on the right side of the report.

3. Enable the Record number column and click Apply.

4. For the specific event in question, copy the number shown in the Record number column.

5. In the same row, identify the source domain controller from the Domain Controller column.

Step 2: Find the event in the Windows Event Viewer  

1. Log in to the domain controller identified in the previous step.

2. Open Event Viewer and navigate to Windows Logs > Security.

3. Use the Find option on the right pane, paste the copied record number, and begin the search. If the event has not been overwritten by newer logs, you should be able to view the original log entry that was captured by ADAudit Plus.

How to reach support  

If you are unable to find the corresponding event in the Event Viewer or have further questions about the data, please contact our support team for assistance.

Related topics and articles  

• Unable to log events to security log: Event ID 521