Active Directory Pro
Login Download Free Trial

AD Audit Pro Install Guide

This guide shows you the installation process for AD Audit Pro.

AD Audit Pro is installed on one computer, a server or a PC, and used from a web browser. It collects the event logs from your domain controllers into its own database, so install it somewhere that stays on: it only collects while it is running.

Before you install

The computer

  • A Windows server or PC joined to the domain you want to audit.
  • You are signed in with an account that is a local administrator on that computer.
  • Port 8081 reachable from the computers people will browse from. If you turn on HTTPS during setup, port 443 too.
  • Disk space for the events you keep. AD Audit Pro installs its own database, so nothing else has to be installed first and no SQL Server licence is needed.

AD Audit Pro does not install anything on your domain controllers. It reads their event logs remotely over the network.

The account AD Audit Pro uses

Choose one of these before you start. The setup wizard asks for it.

Option 1: A managed service account (recommended). A group managed service account (gMSA) or standalone managed service account (sMSA). Windows manages its password, so there is no password to type, store or rotate. The Windows service runs as this account and reads your domain controllers' event logs as itself.

The account must be created and installed before you run the setup wizard. See Set up a managed service account.

Option 2: A normal domain account with a password. The service runs as Local System, and connects to Active Directory with a domain account you choose. The password is stored encrypted on the computer, and only that computer can decrypt it.

Permissions

Whichever option you choose, that account needs to be able to:

  • Read the event log on each domain controller. Add it to the Event Log Readers group in the domain. That group is a domain local group on every domain controller, so adding the account once covers all of them.
  • Read Active Directory. Any normal domain account can do this. AD Audit Pro uses it to find your domain controllers and to look up the users and groups in reports.

A normal domain account is enough. Domain Admins is not required, and AD Audit Pro never writes to Active Directory.

Auditing has to be turned on for the events to exist. AD Audit Pro reads what your domain controllers record. If account logon or directory service auditing is off in Group Policy, those events are never written and nothing can collect them. See Audit Policy Settings.

Step 1: Run the installer

  1. Run the AD Audit Pro installer on the computer.
  2. Follow the prompts.
  3. When it finishes, the setup wizard opens.

Step 2: The setup wizard

The setup wizard has five steps. Nothing is changed until you select Finish setup on the last one, except the Active Directory connection, which is saved when you leave step 2.

Step 1 of 5: Choose the service account

Choose the account the AD Audit Pro Windows service runs as:

  • Local System: the built-in Windows account. Choose this if you are using a normal domain account with a password (Option 2 above).
  • Managed service account: enter the account with a $ on the end, for example CONTOSO\ADAuditSvc$, and select Validate to confirm it is installed on this computer.

Step 2 of 5: Connect to Active Directory

  1. Enter your Active Directory domain, for example ad.contoso.com.
  2. Tick Connect over LDAPS (port 636) if your domain controllers require encrypted LDAP.
  3. If the service runs as Local System, enter the Username and Password of the domain account AD Audit Pro should connect with, as DOMAIN\username. With a managed service account there is nothing to enter; it connects as itself.
  4. Select Test connection. The result appears under the button.
  5. Select Next. The connection is tested again and saved.

Step 3 of 5: Choose the domain controllers

  1. Select Find domain controllers. AD Audit Pro searches the domain and lists what it finds, so you tick them rather than type them.
  2. Tick the ones to collect from. Select all and Select none are there for large domains.
  3. Select Next.

A domain controller marked Already configured keeps its settings and its place in the event log, so running the wizard again does not re-collect what you already have. Clearing a tick stops collection from that domain controller without discarding the events already gathered.

Collection does not start until at least one domain controller is chosen. You can change the list later under Settings > Connections in the app.

Step 4 of 5: Who can sign in

Choose who can open AD Audit Pro.

  • Admin can see everything and change settings.
  • Reader can see reports only.

On a new install, you (the person running the setup wizard) are already listed as an Admin. There must be at least one Admin.

To add someone else, search by name or DOMAIN\username, choose a Role, then select Add. You can add users or groups.

Adding a group is usually easier to manage: anyone you add to the group in Active Directory gets access, and anyone you remove loses it. Changes in group membership take effect the next time the person signs in to Windows.

You can add more people, and change roles, later under Settings > Access in the app.

Step 5 of 5: Review & Finish

  1. Check the summary.
  2. Optionally tick Enable HTTPS, then choose the port (443 by default) and either:
    • Create a self-signed certificate. It is trusted on this computer. Browsers on other computers warn about it until it is trusted there too, for example by deploying it with Group Policy.
    • Use my own certificate (.pfx). Every name people use to open the app must be listed in the certificate's Subject Alternative Name.
  3. Select Finish setup.

The setup wizard then:

  • turns on HTTPS, if you ticked it;
  • saves the domain controllers to collect from;
  • gives the people you added access to the app;
  • sets the service to run as the account you chose, gives that account what it needs to run the service and listen on its port, and restarts the service.

When it finishes, select Open AD Audit Pro.

Step 3: Open the app

  • On the computer where it's installed: use the AD Audit Pro shortcut in the Start menu, or browse to http://localhost:8081.
  • From another computer: browse to http://COMPUTERNAME:8081. With HTTPS on, use https://COMPUTERNAME.

The Start menu shortcut opens the app in your browser once setup is done, and the setup wizard before that. With HTTPS enabled it opens the HTTPS address.

AD Audit Pro uses Windows sign-in. On a domain-joined computer, people are signed in automatically with their Windows account. From a computer that isn't joined to the domain, the browser asks for a username and password: enter your domain account as DOMAIN\username. What people can do depends on the role you gave them.

If people will connect from computers that aren't joined to the domain, turn on HTTPS. Their sign-in is better protected over HTTPS than over plain HTTP.

Collection starts as soon as the service restarts, and the reports fill in as events arrive. Each domain controller's status is shown under Settings > Connections.

Step 4: Activate your licence

Open Settings > License.

  • With internet access: enter your licence key and activate.
  • Without internet access: select the License file tab, choose the signed licence file you were sent, and activate. The file is checked on the computer and is never sent anywhere.

Run the setup wizard again

You can run the setup wizard again at any time, for example to change the service account, add domain controllers, or give someone access. Use the AD Audit Pro Setup shortcut in the Start menu.

It opens on your current settings. Things to know:

  • The password is needed again. If the connection uses a username and password, you have to enter the password again on step 2, even if it hasn't changed.
  • HTTPS is left alone unless you tick the box. If HTTPS is already on, the box offers to replace the certificate; leave it unticked to keep the one you have. To change it later, use Settings > SSL certificate in the app.
  • Domain controllers already configured keep their place. Nothing is re-collected, and nothing already collected is deleted.
  • People already listed keep their access. Adding the same person again does nothing.
  • The app restarts. Finish setup restarts the service, so the app is unavailable for about a minute and collection pauses. It resumes from where it stopped.

Set up a managed service account

AD Audit Pro doesn't create the managed service account, so create it before you run the setup wizard. Replace ADAuditSvc with the name you want, and HOSTNAME with the name of the computer AD Audit Pro is installed on.

  1. Create the account. In PowerShell, on a computer with the Active Directory PowerShell module:

    New-ADServiceAccount -Name "ADAuditSvc" -RestrictToSingleComputer

  2. Allow the AD Audit Pro computer to use it:

    Add-ADComputerServiceAccount -Identity "HOSTNAME" -ServiceAccount "ADAuditSvc"

  3. On the AD Audit Pro computer, install the account:

    Install-ADServiceAccount -Identity "ADAuditSvc"

  4. On the same computer, test it. It should return True:

    Test-ADServiceAccount -Identity "ADAuditSvc"

  5. Add it to Event Log Readers so it can read the domain controllers' event logs:

    Add-ADGroupMember -Identity "Event Log Readers" -Members "ADAuditSvc$"

Then run the setup wizard. On Step 1 of 5, choose Managed service account and enter the account with a $ on the end, for example CONTOSO\ADAuditSvc$. On step 2 there is no username or password to enter; the account connects as itself.