In this article  :

• Question

• Explanation

• Important considerations

• Related topics and articles

 Question 

I would like to know if there’s a way to store historical security event logs within ADAudit Plus, access older logs, and view the raw event data.

 Explanation 

ADAudit Plus collects all security-related events from the configured Domain Controllers and processes them before storing them in its internal database or triggering alerts.

However, ADAudit Plus does not retain every raw event that appears in the native Windows Event Viewer. Instead, it performs selective collection and normalisation based on the reports and alert profiles configured within the product.

Here’s what happens under the hood:

• ADAudit Plus fetches logs from the network in real time.

• It filters out unneeded events according to the audit policies and configurations defined by the administrator.

• The product normalises and processes the required events into a standardised format suitable for reporting and alerting.

• Only the processed and relevant events are stored in the database, not the raw security event logs.

If you want to verify which event categories are being collected, navigate to:
ADAudit Plus > Configuration > Advanced Configuration
Here you can view and customize the events ADAudit Plus captures. You can also refer to event log library.

 Important considerations  

To preserve unaltered EVTX files for forensic analysis, compliance, or deep event correlation, you must set up a parallel log retention mechanism using one of the following methods:

1. Configure Windows Event Forwarding (WEF):

• WEF allows Domain Controllers to automatically forward all Security Event Logs to a central Windows Event Collector (WEC) server.

• This method helps maintain an archive of original EVTX files in one location without manually exporting from each DC.

• For step-by-step guidance, refer to Microsoft’s documentation:
  🔗 Configure Windows Event Forwarding

2. Manual or Automated Export to a SIEM or Collector Tool:

• You can use PowerShell scripts or scheduled tasks to periodically export Security Event Logs from each Domain Controller to a SIEM or log management tool, such as ManageEngine EventLog Analyzer.

• EventLog Analyzer can ingest these EVTX files directly, index them, and provide advanced correlation, search, and retention capabilities.

 Related topics and articles 

• See how EventLog Analyzer helps you with complete Windows event log management.