AD Audit Pro Connection Setup

Set the sources up in this order. Computers reuse the credentials you enter for Domain Controllers, so DCs need to be configured first.

1. Domain Controllers

AD Audit Pro opens a live subscription to each DC's Security log. When a matching event fires on the DC, it flows to AD Audit Pro within a second.

Prerequisites on each DC

A. Audit policy enabled. Via Group Policy on the Domain Controllers OU: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration. Enable Success and Failure per the table below, then run gpupdate /force on each DC.

B. Firewall, enable Remote Event Log Management. Inbound rules NP-In, RPC, and RPC-EPMAP. Usually already permitted between domain-joined machines, but blocked by strict host firewalls.

C. Service account with Security-log read. A domain user that can read the Security log on each DC. Domain Admins qualify. Otherwise, add the account to the Event Log Readers built-in group on the DCs, or grant Manage auditing and security log via GPO.

Audit policy sub-categories

Add the connection

1. In AD Audit Pro, go to Settings > Connections > Domain Controllers.
2. Click Add, or Discover to auto-find DCs in the current domain via LDAP.
3. Enter:
   • Domain Controller Name: FQDN, for example dc1.ad.activedirectorypro.com.
   • Domain Name: the AD domain, for example ad.activedirectorypro.com.
   • Username: the service account, for example svc-adaudit@ad.activedirectorypro.com.
   • Password: the service account password.
4. Check Enabled and click Save.
5. Repeat for each additional Domain Controller.

The status column should flip to Running within 60 seconds. If it stays at Failed with "RPC server unavailable", the firewall is blocking Remote Event Log Management on that DC.

2. Computers

Workstations and member servers. AD Audit Pro polls each computer every 5 minutes for logon events (4624 / 4625 / 4634 / 4647). Authentication uses the credentials from your first Domain Controller connection, so set that up first.

Prerequisites on each target computer

All three are usually applied via a GPO linked to the Computers or Workstations OU.

A. Firewall, enable Remote Event Log Management. Inbound rules NP-In, RPC, and RPC-EPMAP.

B. Security-log access for the DC-connection account. Pick one:

• Preferred: add the account to the local Event Log Readers group via Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups. Update the group and add your service account in DOMAIN\username format (e.g. AD\svc-adaudit).
• Alternative: grant Manage auditing and security log under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.

C. Audit policy enabled. Enable the Logon / Logoff sub-categories from the table in the DC section above. Same GPO can push it to workstations.

Add computers, one at a time

1. Go to Settings > Connections > Computers.
2. Click Add Computer.
3. Enter the Computer Name: short name or FQDN, for example PC-01 or pc-01.ad.activedirectorypro.com.
4. Click Add. First poll fires immediately.

Bulk import from an AD OU

1. Go to Settings > Connections > Computers.
2. Click Import from OU.
3. Select one or more OUs from the AD tree. Only active (non-disabled) computer accounts are shown.
4. Click Select. Every computer under those OUs is added as a manual entry. Duplicates by name are skipped, so re-importing later is safe.

Each computer's Status column shows Running, Pending, Failed, or Disabled. Failed with "Access denied" means the DC-connection account is not in Event Log Readers on that computer.

3. Microsoft 365

AD Audit Pro connects to a Microsoft 365 tenant using an app registration in Entra ID. Once configured, sign-in events flow via Microsoft Graph every 5 minutes, and SharePoint / Teams / Exchange activity via the Office 365 Management Activity API every 15 minutes.

Enable the Unified Audit Log first

Do this before adding the tenant either way. Go to purview.microsoft.com, open Audit, and click Start recording user and admin activity if you see the banner. New tenants have this on by default; older tenants often do not. Without it, subscriptions succeed but no SharePoint / Teams / Exchange events appear.

Two ways to add a tenant

Pick the automated flow for commercial tenants. Government clouds (GCC High and DoD) must use the manual flow because Microsoft does not expose the multi-tenant consent endpoint on those clouds.

1. Connect Microsoft 365, automated (recommended for commercial). One click. AD Audit Pro opens the Microsoft consent screen, a Global Administrator signs in and consents to the required permissions, and the tenant is provisioned. No app registration or client secret to manage. Not available for GCC High or DoD tenants.
2. Add Manually, required for GCC High and DoD. Register an app in Entra ID yourself, grant the permissions, create a client secret, and paste the IDs into AD Audit Pro. Use this path any time you need explicit control over the app registration, or when the automated flow is unavailable (government clouds).

Option 1: Connect Microsoft 365 (automated)

1. Go to Settings > Connections > Microsoft 365.
2. Click Connect Microsoft 365.
3. A Microsoft sign-in page opens. Sign in as a Global Administrator of the tenant.
4. Review the requested permissions and click Accept to grant tenant-wide admin consent.
5. You are redirected back to AD Audit Pro. The tenant appears in the list and polling starts within a minute.

The Global Administrator credential is only used to consent to the app. AD Audit Pro never stores the admin's password. Ongoing polling uses the app's own service principal with the granted permissions.

Option 2: Add Manually (required for GCC High and DoD)

Register the app in Entra ID

1. Go to entra.microsoft.com > App registrations > New registration. For GCC High use entra.microsoft.us.
2. Name it whatever you like (e.g. AD Audit Pro). The name is just a label in Entra ID for your own reference; AD Audit Pro doesn't check it.
3. Supported account types: Accounts in this organizational directory only.
4. Redirect URI: leave blank.
5. Click Register.
6. Copy the Application (client) ID and Directory (tenant) ID from the app's Overview page. You will paste these into AD Audit Pro later.

Grant API permissions

1. In the app, open API permissions > Add a permission > Microsoft Graph > Application permissions, and add:
   • AuditLog.Read.All (sign-ins and directory audits)
   • Directory.Read.All
   • User.Read.All
   • Group.Read.All
2. Then Add a permission > APIs my organization uses > Office 365 Management APIs > Application permissions, and add:
   • ActivityFeed.Read (SharePoint, Teams, Exchange, admin activity)
3. Click Grant admin consent for [tenant]. All Application permissions require this.

Create a client secret

1. In the app, open Certificates & secrets > New client secret.
2. Description: any label (e.g. AD Audit Pro). Expires: 24 months, or match your policy.
3. Click Add, then copy the Value immediately. Microsoft will not show it again after you leave the page.

Add the tenant in AD Audit Pro

1. Go to Settings > Connections > Microsoft 365.
2. Click Add Manually.
3. Enter:
   • Name: a friendly label, for example Active Directory Pro.
   • Tenant ID: the Directory (tenant) ID you copied earlier.
   • Client ID: the Application (client) ID you copied earlier.
   • Client Secret: the value you copied from Certificates & secrets.
   • Cloud: Commercial, GCC High, or DoD.
4. Click Save. Polling starts immediately.

Sign-in events appear within 5 minutes. SharePoint, Teams, and Exchange events can lag 15 to 30 minutes because Microsoft aggregates them on their side before publishing.

Troubleshooting