Browse documentation
The AD Audit console
↩ AD Audit
AD Audit is four surfaces, not one page: a dashboard, a search, a report catalogue, and findings.
The dashboard
The landing page answers "is anything wrong in the directory?" with KPI sparklines, all-clear chips for the things that are fine, and collector health — because audit data that stopped arriving looks exactly like a quiet directory.
Findings
Ranked findings call out what deserves attention. A finding can be dismissed once you've judged it acceptable, so the list stays meaningful rather than becoming wallpaper.
Event search
Event browsing lives on its own search page — filters, time ranges and export, over everything collected. See Reviewing audit events.
The report catalogue
Around twenty prepared reports, grouped into five categories:
| Category | Covers |
|---|---|
| User Logon | Who signed in, where, and when. |
| Logon Analysis | Patterns across logons rather than individual events. |
| Account Management | Accounts created, changed, disabled, deleted. |
| Group Management | Membership changes, especially privileged groups. |
| LAPS coverage | Which machines have local administrator password management, and which don't. |
Reviewing events
Individual events can be marked reviewed, so a second person can tell what's already been looked at.
Audit policy detection
The console can read the audit policy from each domain controller and tell you what it's actually configured to log. This is the setting that explains most "why are there no events?" questions: if the DC isn't auditing a category, nothing will ever arrive for it, no matter how JOATOS is configured.
Audit-policy detection needs the endpoint agent at 0.4.2 or later on the domain controller.
Notes & tips
- Check collector health before concluding the directory has been quiet.
- LAPS coverage is the report most likely to surface something you didn't know, because gaps in it are invisible from the directory itself.