In this article:  

• Issue description

• Prerequisites

• Possible causes

• Resolution

• Related topics and articles

• When and how to reach support

Issue description:  

In ADAudit Plus, the Azure AD Password Protection Reports profile provides insights into password changes, password change failures, and password set failures. However, in some cases, users may find that no data is available under this profile. This issue typically arises due to misconfigurations, insufficient privileges, or communication failures between ADAudit Plus and the domain controllers. This document provides a structured approach to diagnosing and resolving this issue.

Prerequisites:  

Before troubleshooting, ensure the following prerequisites are met:

• All domain controllers are configured in ADAudit Plus.

• Required ports and firewall rules are enabled to allow communication between the Domain Controller and ADAudit Plus.

• The service account used in ADAudit Plus is a member of the Event Log Readers group.

• The Event Log retention size is at least 4 GB to prevent log overwrites.

Possible causes:  

• Domain controllers are not configured in ADAudit Plus, preventing data collection.

• Communication failure between ADAudit Plus and the Domain Controller due to RPC-related issues.

• The service account lacks the necessary permissions to collect security event logs.

• Event log size is too small, causing logs to be overwritten before collection.

• Files are stuck in the event data/raw or processed directories of ADAudit Plus.

Resolution:  

Step 1: Verify Domain Controller configuration  

1. Navigate to the Domain Settings tab in ADAudit Plus.

2. Confirm that all necessary domain controllers are properly configured.

Step 2: Check for communication issues  

1. If log collection fails, check for RPC-related errors.

2. If encountering "RPC Server Unavailable (Error Code 6ba)", refer to the troubleshooting guide.

Step 3: Verify service account permissions  

To check the service account configured in ADAudit Plus:  

1. Go to Domain Settings.

2. Click the dropdown next to the domain name.

3. Select Modify Credentials.

Grant necessary permissions:  

1. Open Active Directory Users and Computers.

2. Navigate to Built-in > Event Log Readers.

3. Right-click Event Log Readers > Members > Add the configured service account.

Step 4: Check for stuck files in event data folder  

1. If files are stuck in event data/raw or processed directories, contact ManageEngine Support for assistance.

Related topics and articles:  

• Troubleshooting Windows Event Log Collection

• Configuring Domain Controllers in ADAudit Plus

• Understanding ADAudit Plus Service Account Permissions

How to reach support: