1. System diagram
Everything runs on a single Windows host. AD Audit Pro is one process; PostgreSQL is embedded and started by the app.
2. Background services
Everything AD Audit Pro does in the background is a hosted service inside the same process. There is no separate agent or worker.
| Service | Cadence | What it does |
|---|---|---|
| EventWatcher | Push (live) | Opens a persistent Windows Event Log subscription to each configured Domain Controller. Delivers matching events within seconds of them being written. |
| WorkstationWatcher | Every 5 min | Polls each enabled computer for logon events (4624 / 4625 / 4634 / 4647) since the per-computer bookmark. TCP-probes port 135 first to skip offline machines quickly. |
| GraphWatcher | Every 5 min | Pulls sign-ins and directory audits from Microsoft Graph for each M365 tenant. |
| ManagementWatcher | Every 15 min | Pulls SharePoint, Teams, Exchange, and admin activity from the Office 365 Management Activity API. |
| AlertEngine | Reactive | Subscribes to all watchers' new-event streams, evaluates alert rules in memory, writes matching Alerts to the database and emails recipients. |
| Retention | Every 24h plus startup | Purges events older than the configured windows. Uses a midnight-based cutoff so multiple restarts in a day do not re-purge. |
| DiskSpaceMonitor | Every 30 min | Watches the drive holding the PostgreSQL data directory. Raises an alert on the transition past 80% used. |
| Backup | Scheduled | Runs on the schedule set in Settings > Database. Uses pg_dump to produce an encrypted archive; deletes the oldest when the retain count is exceeded. |
| Update | Every 12h | Checks the update server for a newer version. Only surfaces a banner, never installs automatically. |
| License | Daily | Refreshes trial state and validates the license against the update server. |
| ScheduledReports | Every minute | Fires any due scheduled reports (daily / weekly / monthly). Delivers by email or writes to disk. |