Active Directory ProActive Directory Pro
Book a demo Free Trial

AD Audit Pro Release Notes

v1.2.1

August 16, 2026

New

  • Computers tab pulls logon events (4624 / 4625 / 4634 / 4647) from any domain-joined machine every 5 minutes. Add one at a time or bulk-import from an AD OU with the built-in picker. Uses the credentials from your first Domain Controller connection, so one grant covers both.
  • Split retention windows under Settings > Database. Audit events default to 365 days; AD Logon Events (4624 / 4625 / 4634 / 4647) get their own 90-day window, cutting DB size without touching audit history.
  • Disk-space monitor. Alerts and emails when the PostgreSQL drive crosses 80% used. Database settings page shows current usage as a colored bar.
  • Horizontal top navigation with a contextual left sidebar. Six pills under the titlebar; sidebar shows only the active section’s tree. “All Audit Logs” renamed to “Unified Events”.
  • Event Filters page rebuilt as one sortable, searchable table with Yes/No pill toggles. Logon types, health channels, and noisy-AD toggles all live in the same list; filter by category, event ID, or text.
  • User / Computer Summary report (Active Directory > Logons). One row per user and computer with success and failed counts plus first and last seen.
  • Daily Logon Summary linked under Active Directory > Logons.
  • Microsoft 365 > Logons gained two matching reports: User / Application Summary and Daily Logon Summary.
  • Events Collected page rebuilt as one sortable, searchable table. AD events and health channels sit in the same list.

Improved

  • Retention purge runs once per calendar day with a midnight-based cutoff, so restarts within a day no longer trickle events past the boundary. Every run writes a log line.

v1.2.0

August 12, 2026

New

  • Microsoft 365 cloud support for GCC High and DoD. Each tenant connection carries a Cloud value (Commercial, GCC High, DoD); the app talks to the matching Graph, login, and Office 365 Management Activity API endpoints. Add Manually shows a Cloud dropdown so a single install can host commercial and government tenants side by side.
  • Sidebar-only navigation. The top tab bar is gone; six top-level collapsibles (Dashboards, All Audit Logs, Active Directory, Microsoft 365, Alerts, Settings) replace it, with nested groups (Users, Computers, and so on) that also collapse. The current page’s enclosing group auto-opens.
  • Titlebar overhaul. Current user chip (click to see role), a tenant switcher that appears when more than one M365 connection exists (persisted in the browser), and an alerts bell with a live badge for unacknowledged alerts.
  • Per-tenant M365 views. Picking a tenant from the titlebar filters /m365-events, every M365 report page, the M365 dashboards, and the Risky Sign-Ins widget on the Security dashboard.
  • Scheduled reports can save to disk instead of emailing. New Delivery dropdown picks Email or Save to Disk; the save target is a local path or UNC share, with a server-side folder browser next to the input.
  • Adding or editing an M365 tenant fires an immediate poll, so the badge flips off “Pending” within seconds instead of waiting for the next 5-minute cycle.
  • Event Log channel row in the event detail dialog (Security, System, DNS Server, and so on) so you can tell at a glance which channel the event came from.
  • Alert emails include a Details line for events that carry one (for group membership alerts this is the member that was added or removed).
  • “Errors only” toggle under Settings > Event Filters for the System Health channels, so AD DS / DFSR / DNS / ADWS / NTLM capture only Error-level events.

Improved

  • Removed the Reports.Read.All permission from the auto-connect app registration (never used by the app).
  • Historical M365 Pull tolerates per-feed failures: a tenant without Entra ID P1 still gets directory audits pulled instead of the whole run aborting on the first sign-ins 403.
  • Settings > Connections “Last Event” column loads instantly. Was a GROUP BY over the entire Events table (3-4 seconds on busy databases); now one MAX(TimeStamp) per configured DC.
  • Log-spam OutOfMemory guard extended into the per-record path on both the security and health-channel watchers; dying subscriptions no longer spray “handle is invalid” through that code path either.
  • Sidebar width bumped to 250px; long wrapped labels don’t crowd each other; deeper items indent properly under their parent.

Fixed

  • Cross-forest and cross-subdomain event log auth now works: the username sent to the DC is qualified to user@domain, so DCs in a different forest authenticate correctly.
  • Log message for Management Activity API “tenant does not exist” now points at the real causes (Unified Audit Log not enabled, or wrong consent target) instead of a scary stack trace.
  • 502 / 503 / 504 responses from Microsoft’s Management API are logged as one-line warnings instead of dumping the HTML error page as an error.

v1.0.15

July 20, 2026

Improvements

  • Password Spray report loads instantly on large event tables (was timing out).
  • Detail dialog shows the source event log channel (Security / System / DNS Server / etc.).
  • Alert emails include parsed event details (e.g. which member was added/removed).
  • New “Errors only” toggle for System Health channels, which skips Warning-level noise.

Bug Fixes

  • Cross-domain DCs now authenticate correctly (username qualified to user@domain).
  • Prevented log-spam-driven crash from dying subscriptions.
  • Subscription-died log lines now include exception type, HResult, and stack.

v1.0.13

July 7, 2026

Improvements

  • AD Summary Dashboard renders instantly. All 7 cards appear immediately with per-tile spinners; counts fill in as each query completes instead of blocking the whole page.
  • Row-count caching. Counters no longer re-run on every page click. Cache is per-filter and lives until you change filters.
  • Live event counters update in real time. When new events arrive from a DC, the row counter increments immediately without touching the database.
  • Added loading spinners when report pages are loading.
  • Added Password spray and after hours reports and linked to security dashboard.
  • Removed dedup of 5156 from /ad-events and /audit-logs due to performance issues. Individual report pages still dedup.

v1.0.12

July 7, 2026

Improvements

  • Event dialog now decodes Windows FileTime attributes inline (LAPS, pwdLastSet, lastLogon, accountExpires, lockoutTime, badPasswordTime). Raw ticks are kept; the readable date is shown next to them.
  • About page now shows a Download button when an update is available (previously only in the header chip).
  • “Subscription died” log lines now include the exception type and HResult in hex (e.g. EventLogException (HResult=0x80070006): The handle is invalid.), plus inner exception if any. Makes it possible to Google or match to a specific Win32 error code.

v1.0.11

July 5, 2026

Fixed

  • Eliminated “subscription died” log spam.
  • Search now finds names with underscores.
  • Last Event column on Connections page no longer breaks when the same DC name has been captured with mixed casing. Query now normalizes case before grouping.

Improvements

  • SoftDelete and SendAs added to Event Filters, off by default.
  • Info tooltips on Connections page columns.
  • Event ID moved to the right on /ad-events.
  • Startup log now summarizes DCs and health channels subscribed.

v1.0.9

July 1, 2026

Improvements

  • Deduplicated attribute-change bursts. A single AD modification (e.g. “set password never expires”) fires several correlated 5136 events. The grid now shows one row per logical change; the View dialog still aggregates the full attribute-change table.
  • Correlation ID row added to event detail dialogs when the event carries one.
  • Consistent Message text. 5136 events now show the same General-tab wording Event Viewer shows, instead of a shortened one-liner.
  • Consolidated event detail dialogs. All AD reports, /ad-events, and /audit-logs now share a single AD dialog implementation; M365 reports and /audit-logs share a single M365 dialog. No more small rendering differences between pages.
  • Full detail everywhere. All Audit Logs now fetches the full record on View click, so the dialog shows the same fields as it does when opened from a report page.
  • Missing-record warning. If an event has been purged by retention, clicking View shows a small snackbar warning instead of doing nothing.

Fixed

  • Renamed Users / Renamed Groups reports no longer show identical records for the same rename operation.
  • Restart & Shutdown / Errors & Warnings reports show correct page title in header (was showing “AD Audit Pro” placeholder).

v1.0.3

Mailbox reports

  • Mailboxes Created
  • Mailboxes Deleted
  • Mailboxes Enabled
  • Mailboxes Disabled
  • Mailboxes Modified
  • Permission Changes
  • Send As / On Behalf
  • Inbox Rules
  • Forwarding & Auto-Reply
  • Mail Item Deletions
  • Mailbox Owner Access
  • Transport Rules
  • Inbound Connectors
  • Outbound Connectors
  • Journal Rules
  • Accepted Domains
  • Remote Domains
  • Transport Configuration

v1.0.0

Active Directory auditing

  • Real-time security log watching on configured domain controllers. New events appear in the UI as they occur.
  • Captured event categories: Users (created, enabled, disabled, deleted, changed, locked, unlocked, renamed); Computers (created, modified, deleted); Groups (created, deleted, member added, member removed); Passwords (user change, admin reset); Logons (success, failure, logoff, user-initiated logoff); Directory / GPO (object created, modified, deleted, restored, moved); OUs (changes to organizational units, created, deleted, moved).

Microsoft 365 auditing

  • Multi-tenant. Add and manage multiple Azure AD tenants independently from one install.
  • 38+ tracked operations across 9 categories: Users (created, deleted, modified, enabled, disabled, hard-deleted, restored, license changed, MFA enabled/disabled); Groups (created, deleted, modified, restored, members added/removed); Passwords (user change, admin reset, force-change requirement); Roles (member add/remove, role create/update/delete, PIM-eligible add/remove, PIM activation); Applications (app registration created/deleted/modified, service principals, role assignments, consent); Sign-ins (success and failure with error codes); SharePoint (file access, preview, download, upload, modify, delete, restore, rename, move, copy, folder ops, sharing settings, anonymous links, site permissions); Teams (team/channel create/delete/restore, settings, member add/remove/role change, tenant settings, policies).
  • Exports: CSV, Excel, PDF.

Alerting

  • Real-time rule-based alerts fire as AD or M365 events occur.
  • 11 pre-seeded default rules out of the box (user deleted, admin group changes, MFA disabled, account lockout, and more), plus full custom rule creation in the UI.
  • Rule conditions: event type, source (AD / M365 / Both), wildcard patterns on actor and target, severity (Critical / Warning / Info).
  • Trigger modes: Immediate (every match) or Threshold (fire when N occurrences happen within a time window up to 30 minutes) for built-in dedup and storm prevention.
  • Delivery: email to comma-separated recipients and/or in-app inbox.
  • In-app alert inbox with filtering by date range, acknowledged status, and free-text search; shows severity, source, rule, target, and actor.
  • Acknowledgement flow: ack individual alerts or all at once; tracks who acknowledged and when.

Scheduled reports

  • Frequency: Daily, Weekly (pick day of week), or Monthly (pick day of month), each with a specific hour/minute.
  • Date ranges: Last 24 hours, 7 days, 30 days, or 90 days.
  • Formats: PDF, Excel, or CSV.
  • Delivery: email attachment to per-schedule recipient list.
  • Run tracking: last-run timestamp and error message stored per schedule; schedules can be enabled or disabled individually.