Setting up AD auditing

↩ AD Audit

AD Audit reads the Security event log from your domain controllers and turns the raw events into structured, searchable records. This article covers getting it collecting.

Before you start

• Enable the AD Audit module (Settings → Modules). It's off by default.
• The domain controller must already exist in JOATOS as a server. How JOATOS reads its Security log depends on the collection method you choose (below).

Collection method

Each DC is collected one of two ways, chosen when you add it:

Agent-based collection means running the endpoint agent on a domain controller — make sure that fits your security policy. Supported since endpoint agent v0.3.9: the agent reads the DC's Security log directly and reports the audited events. It must run as the installed service (LocalSystem) — which has the access needed to read the Security log — so install it via install-service.ps1, not as a plain console app. The DC must also have the relevant audit policy enabled (e.g. Audit User Account Management, Audit Security Group Management) or those events are never written for the agent to read.

Adding a domain controller

Managing which DCs are audited lives in Settings (admin only). The AD Audit page under Operations is for viewing and searching the collected events — open its Manage button (top-right) to jump to these settings.

1. Open Settings → AD Audit (under Monitoring & Alerts), or the Manage button on the AD Audit page.
2. In Audited Domain Controllers, select Add DC.
3. Choose the server (its domain-controller role) and the collection method (Site collector or Endpoint agent — JOATOS warns if the prerequisite isn't met). Optionally enter the AD domain (e.g. corp.example.com), and pick which categories to collect:
   • Account changes (on)
   • Group changes (on)
   • Computer accounts (on)
   • Directory object changes (on)
   • Failed logons + lockouts (on)
   • Successful logons (off — high volume)
4. Select Add.

If the chosen server has no WMI/WinRM credential, JOATOS warns you — the collector can't read the Security log until one is set.

Once added, the DC appears in the list with its categories, an enabled/paused toggle, and its last-scan time. The collector then polls its Security log and events begin to appear.

Keeping volume in check

AD security logs can be noisy. There is no daily ingest cap — nothing is discarded for hitting a limit. What bounds the table is retention plus your plan's metered storage: logon events are kept for a window you can set under Settings → Data & Retention, and change events are kept for five years.

Volume is still worth managing, because it consumes storage. The lever is the categories you enable per DC — leave Successful logons off unless you specifically need them, as it's the high-volume one.

Stopping collection

Use the toggle to pause a DC, or remove it entirely. Removing a DC keeps the events already collected — it only stops new collection.

Notes & tips

• Start with the default categories; add Successful logons only when you have a specific need, as it's high-volume.
• Logon retention is tunable under Settings → Data & Retention; change-event retention is fixed at five years.

Related

• Reviewing audit events
• Adding a server
• Enabling and disabling modules