In this article         

• Issue description

• Prerequisites

• Possible causes

• Resolution

• Related topics and articles

• When and how to contact support

 Issue description
 The Computer Startup and Shutdown reports in ADAudit Plus display "No Data Available," preventing the monitoring and auditing of system startup and shutdown events. This issue may occur due to missing prerequisites, misconfigured audit policies, or insufficient permissions assigned to the service account.

 Prerequisites 

• Ensure the monitored system is added and configured in ADAudit Plus.

• Verify that the ADAudit Plus service account has the necessary privileges for event collection.

• Confirm that the required audit policies are enabled to track local account management events.

• Ensure the Event Log size is sufficient to retain logs before collection.

 Possible causes 

• Insufficient Privileges The service account lacks the required permissions.

• Log Collection Failure Required RPC ports (135, dynamic ports 49152-65535) are open bidirectionally or at least inbound on the target server. Windows Firewall allows Remote Event Log Management and COM+ Network Access (DCOM-In).

• Event Log Retention Issue Logs are purged before collection due to incorrect settings.

• Event ID 521 Unable to Log Events to Security Log The security event log is failing to capture relevant events.

• Misconfigured Audit Policies Startup and shutdown auditing policies are not configured properly.

 Resolution  

 Insufficient privileges 

• Ensure that the service account configured in ADAudit Plus has the required privileges to collect and report Computer Startup and Shutdown events. If the necessary permissions are not assigned, event logs may not be captured.

https//www.manageengine.com/products/active-directory-audit/help/quickstart/privileges-required-for-ad-windows-server-workstation-audit.html

  Fix log collection failure (RPC Service Unavailable)     

Ensure the required ports are enabled in the Firewall rules.

• COM+ Network Access (DCOM-In)

• Remote Event Log Management( RPC)

• Remote Event Log Management( NP-IN)

• Remote Event Log Management( RPC-EPMAP)

To enable

• Open Windows Defender Firewall and navigate Advanced Security.

• Navigate to Inbound Rules.

• Locate and enable the required rules.

https//www.manageengine.com/products/active-directory-audit/help/quickstart/ports.html  

 Validate and configure event log retention
  Ensure the maximum security log size is set to at least 4GB.

1. Open GPMC and edit the ADAuditPlusComputerStartupPolicy GPO.

2. Navigate to

• Open Computer Configuration

• Navigate to Policies

• Open Windows Settings

• Navigate to Security Settings

• Open Event Log

3. Configure the following settings

• Retention method for security log Overwrite Events As Needed

• Maximum security log size Set to 4GB

https//www.manageengine.com/products/active-directory-audit/help/data-source/windows-server-audit-configure-event-log-settings.html

Fix Event ID 521 (Unable to log events to security log)
Since ADAudit Plus relies on Event Viewer, it only retrieves the events logged there. If Event ID 521 appears, it indicates that the system failed to log security events.

 Possible causes 

 Security log full 

• Open Event Viewer

• Navigate to Windows Logs

• Security.

• Check if the log size has reached its limit.

• Increase the maximum log size in GPMC as described in Step 2.

 Event logging is disabled 

• Open Command Prompt as an Administrator.

• Run auditpol /get /category*

• Ensure that Audit Policy Change is enabled.

 Windows event log service not running 

• Open Run (Win + R), type services.msc, and press Enter.

• Locate Windows Event Log service, ensure it is running and set to Automatic.

For more details, refer to Microsoft's official documentation on Event ID 521.

Ensure required audit policies are enabled     

1. Log in to a system with Group Policy Management Console (GPMC) using Domain Admin credentials.

2. Open GPMC and navigate to

• Default Domain Controllers Policy

• ADAuditPlusComputerStartupPolicy

3. Right-click the policy and select Edit.

4. In the Group Policy Management Editor, go to Computer Configuration

5. Navigate to Policies

6. Open Windows Settings

7. Navigate to Security Settings

8. Open Advanced Audit Policy Configuration move to Audit Policy.

9. Double-click on the relevant policy setting.

Required audit policies

https//www.manageengine.com/products/active-directory-audit/help/data-source/adlds-audit-configure-audit-policies.html

 Related topics & documentation 

• Minimum privileges required

• Steps to Enable Required Audit Policies

• Configuring Event Log Settings 

• Understanding Windows Security Log Event ID 521

• Steps to enable Firewall ports 

When and where to reach support