User Access

1. How it works

Two layers: Windows authenticates the visitor, then AD Audit Pro decides the role.

1. Windows authentication. The browser passes the visitor's Windows credentials to AD Audit Pro (Kerberos or NTLM). The visitor never types a username or password into the app.
2. Access-control lookup. AD Audit Pro checks whether the visitor matches an entry on the User Access page, either directly (User entry) or via AD group membership (Group entry).
3. Role applied. The matching entry's role (Admin or Reader) determines what the visitor sees and can do for that session.

Group membership is resolved against AD by LDAP at request time. Nested groups count: if DOMAIN\ADAuditReaders contains DOMAIN\ITStaff, members of ITStaff pick up the Reader role.

2. Roles

Two roles cover the day-to-day. There is no per-page permission grid.

Admin, full access. Everything an operator needs. Can change configuration and grant access to others.

• View every dashboard, report, and event
• Manage connections (Domain Controllers, Computers, Microsoft 365)
• Change every Settings page (Database, Email, SSL, Event Filters, License)
• Create and edit alert rules and scheduled reports
• Manage this User Access list

Reader, read-only plus alert acknowledgement. For analysts and helpdesk who consume the data but don't change how the app runs.

• View every dashboard, report, and event
• See alerts and acknowledge them
• Cannot open Settings pages
• Cannot manage connections, alert rules, or scheduled reports

3. Add, edit, remove access

Add a user or group

1. Go to Settings > User Access.
2. Click Add User or Group.
3. Pick Type:
   • User, a single Windows account (e.g. AD\jsmith).
   • Group, an AD security group; every member picks up the role.
4. Start typing the name. AD Audit Pro looks up matches in AD and suggests candidates. Pick one from the list.
5. Pick a Role: Admin or Reader.
6. Click Save. The entry is active immediately, the next request from that user or group member gets the new role.

Prefer Group entries over User entries. Creating one ADAuditAdmins and one ADAuditReaders group in AD, and mapping each here, means you can grant and revoke access by changing group membership without touching AD Audit Pro at all.

Edit a role

1. Click the edit icon on the entry's row.
2. Change the Role.
3. Click Save.

Remove an entry

1. Click the delete icon on the entry's row.
2. Confirm the removal.

Removing an entry does not sign anyone out. The next request from the affected user is re-evaluated against the remaining entries.

4. Guardrails

No entries means open access

When the User Access list is empty, every authenticated Windows user has full Admin access. This is the initial state so you can reach the app for the first time and configure it. As soon as you add the first entry, access control is enforced.

Add yourself first. If you add an entry for another user or a group you don't belong to, and then leave the page, the next request checks your account against the list, doesn't find it, and locks you out.

Removing the last entry

Trying to remove the last remaining entry shows a warning: doing so returns the app to "open access" mode where every authenticated user is Admin again. The delete goes through if you confirm; use this deliberately if you want to reset access control.