Supported operating systems
- Windows Server 2016 or later
- Windows 10/11
- We recommend deploying it on a machine that runs 24 x 7, so events are captured continuously.
Required software
Nothing to install separately. The .NET runtime and PostgreSQL database are bundled inside the installer.
- Visual C++ Redistributable 2015 to 2022 (x64), installed automatically if missing
- .NET 10 runtime, shipped inside the installer, no separate download
- PostgreSQL database, embedded, started and managed by the app
Minimum hardware requirements
| Resource | Minimum |
|---|---|
| CPU | 4 cores |
| Memory | 8 GB RAM |
| Storage | 100 GB available disk space (more for large fleets or long retention) |
Disk usage grows over time, depending on your Active Directory audit volume and how long you keep logs.
Firewall
On each Domain Controller
- Remote Event Log Management, required to read the Security event log
- Port 389, LDAP discovery and connectivity
On each polled computer (workstations and member servers)
- Remote Event Log Management, required to read the Security event log for logon events (4624 / 4625 / 4634 / 4647)
On the AD Audit Pro host
- Inbound TCP 8081, browser access to the app (HTTP, default)
- Inbound TCP for HTTPS, if SSL is enabled in Settings, the port you chose
- Outbound HTTPS (443), Microsoft Graph and Office 365 Management API for M365 audit, and the update check
Microsoft 365 (optional)
Only required if you want AD Audit Pro to collect Microsoft 365 audit data. Skip this section if you only need on-premises Active Directory auditing.
- Entra ID app registration in the tenant you want to audit
- Admin consent granted for Microsoft Graph and Office 365 Management API permissions
- Unified Audit Log enabled in Microsoft Purview (new tenants have this on by default)
- See Connection Setup for step-by-step