AD Audit Pro Connection Setup

Set the sources up in this order. Computers reuse the credentials you enter for Domain Controllers, so DCs need to be configured first.

1. Domain Controllers

AD Audit Pro opens a live subscription to each DC's Security log. When a matching event fires on the DC, it flows to AD Audit Pro within a second.

Add the connection

In AD Audit Pro, go to Settings > Connections > Domain Controllers.
Click Add, or Discover to auto-find DCs in the current domain via LDAP.
Enter:
- Domain Controller Name: FQDN, for example dc1.ad.activedirectorypro.com.
- Domain Name: the AD domain, for example ad.activedirectorypro.com.
- Username: the service account, for example svc-adaudit@ad.activedirectorypro.com.
- Password: the service account password.
Check Enabled and click Save.
Repeat for each additional Domain Controller.

The status column should flip to Running within 60 seconds. If it stays at Failed with "RPC server unavailable", the firewall is blocking Remote Event Log Management on that DC.

2. Computers

Workstations and member servers. AD Audit Pro polls each computer every 5 minutes for logon events (4624 / 4625 / 4634 / 4647). Authentication uses the credentials from your first Domain Controller connection, so set that up first.

Prerequisites on each target computer

All three are usually applied via a GPO linked to the Computers or Workstations OU.

A. Firewall, enable Remote Event Log Management. Inbound rules NP-In, RPC, and RPC-EPMAP.

B. Security-log access for the DC-connection account. Pick one:

Preferred: add the account to the local Event Log Readers group via Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups. Update the group and add your service account in DOMAIN\username format (e.g. AD\svc-adaudit).
Alternative: grant Manage auditing and security log under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.

C. Audit policy enabled. Enable the Logon / Logoff sub-categories from the table in the DC section above. Same GPO can push it to workstations.

Add computers, one at a time

Go to Settings > Connections > Computers.
Click Add Computer.
Enter the Computer Name: short name or FQDN, for example PC-01 or pc-01.ad.activedirectorypro.com.
Click Add. First poll fires immediately.

Bulk import from an AD OU

Go to Settings > Connections > Computers.
Click Import from OU.
Select one or more OUs from the AD tree. Only active (non-disabled) computer accounts are shown.
Click Select. Every computer under those OUs is added as a manual entry. Duplicates by name are skipped, so re-importing later is safe.

Each computer's Status column shows Running, Pending, Failed, or Disabled. Failed with "Access denied" means the DC-connection account is not in Event Log Readers on that computer.

3. Microsoft 365

Before you start

A Global Administrator account for the tenant. Creating an app registration and granting admin consent both need it.
The unified audit log turned on in Microsoft Purview. It is on by default in current tenants. Without it, the Exchange, SharePoint and Teams reports have nothing to read.
A Microsoft Entra ID P1 or P2 licence for the sign-in reports. The sign-in logs are not available through the API on a tenant without one. The directory audit reports do not need it.

You can run the script from any computer with PowerShell and internet access. It does not have to be the server AD Audit Pro is installed on.

Step 1: Create the app registration

In AD Audit Pro, open Settings > Connections, on the Microsoft 365 tab.
Select Download setup script. The file is Setup-ADAuditProAppRegistration.ps1.
Run it in PowerShell:
```
.\Setup-ADAuditProAppRegistration.ps1
```

The script walks through this:

The module. It needs Microsoft.Graph.Authentication, the small sign-in-only module, not the full Microsoft.Graph set. If it isn't installed the script shows the command and asks before installing anything. It installs for your account only, so no administrator rights are needed on the computer.
Sign in. A browser window opens for you to sign in as a Global Administrator.
Confirm. Before changing anything, the script prints the account you signed in as and the tenant name, says whether it will create or update the registration, and asks you to continue. A cached sign-in means no prompt appears, so this is your chance to catch the wrong tenant.
It does the work. Creates the app registration, adds the three permissions, grants admin consent, and creates a client secret that lasts 12 months.
It prints three values. Tenant ID, Application (client) ID and Client Secret.

Copy all three now. The client secret is shown only once and cannot be retrieved afterwards. If you lose it, run the script again to create another.

It is safe to re-run. Every step checks whether the change is already in place, and a permission another product added to the same registration is left alone.

Options

Option	What it does
`-DisplayName`	The name of the registration to create or update. Default "AD Audit Pro".
`-AppId`	Update an existing registration by its Application ID, instead of finding one by name.
`-TenantId`	Sign in to a particular tenant, rather than choosing at sign-in.
`-SecretMonths`	How long the client secret lasts. Default 12.
`-NoSecret`	Don't create a client secret, if you manage secrets separately.
`-Force`	Don't ask for confirmation, and install the module without asking.

If there is more than one registration with the same name, the script stops and lists them rather than guessing. Run it again with -AppId set to the one you want.

Step 2: Add the tenant

In AD Audit Pro, on the Microsoft 365 tab, select Add Tenant.
Fill in:
- Connection Name - anything that identifies the tenant, for example "Production Tenant".
- Tenant ID, Application (Client) ID and Client Secret - the three values the script printed.
- Cloud - Commercial (worldwide and GCC), GCC High, or DoD.
Leave Enabled ticked and save.

Collection starts straight away. The tab shows each tenant's last sync and any error.

Consent can take a few minutes. If the first sync fails with a permissions error right after you run the script, wait a few minutes and let it try again.

What AD Audit Pro collects

Permission	Granted on	Used for
`AuditLog.Read.All`	Microsoft Graph	Sign-in logs and directory audit logs
`Directory.Read.All`	Microsoft Graph	Resolving the users, groups and licences named in those logs
`ActivityFeed.Read`	Office 365 Management APIs	The unified audit log: Exchange, SharePoint and Teams activity

Those feed the reports as follows:

Sign-in reports - all user logins, failed logins, blocked logins, daily logon summary, last logon. Collected every 5 minutes.
Directory reports - users and groups created, deleted, enabled and disabled, group member changes, admin role changes. Collected every 5 minutes.
Exchange, SharePoint and Teams reports - mailbox access, file activity, Teams policy and guest access changes. Collected every 15 minutes.

Microsoft publishes no delivery-time guarantee for these feeds. An event can appear in the API some minutes after it happened, so a very recent action may not be in a report immediately.

Renew the client secret

The secret the script creates lasts 12 months by default. When it expires, collection stops and the tenant shows an authentication error.

To renew it, run the script again. It finds the existing registration, leaves the permissions and consent as they are, and creates a new secret. Paste that secret into the tenant in Settings > Connections > Microsoft 365.

Set a reminder before the expiry date, or run the script with a longer -SecretMonths to begin with.

Government clouds

The script signs in to the commercial Microsoft cloud, which serves commercial and GCC tenants.

For GCC High and DoD tenants, create the app registration by hand in the Entra portal with the three permissions in the table above, grant admin consent, create a client secret, then add the tenant in AD Audit Pro with the matching Cloud selected.