ADAudit Plus Quick Start Guide

This guide takes you through a first ADAudit Plus deployment, from sizing the server to auditing your first domain controller. It follows ManageEngine's ADAudit Plus Quick Start Guide and adds current details from ManageEngine's online documentation. It was written by Optrics Engineering, ManageEngine's Canadian partner in Edmonton, Alberta.

Last reviewed September 2026. Product details come from ManageEngine; check ManageEngine's online help for changes in newer builds.

How do I set up ADAudit Plus?

Setting up ADAudit Plus takes five steps: prepare a Windows server that meets the system requirements, configure Windows audit policies and security log settings on the computers you want to audit, install ADAudit Plus (preferably as a Windows service), sign in to the web console and connect it to your domain, then add the domain controllers, servers, file servers and workstations you have licensed.

1. Check the system requirements
2. Configure audit policies, log sizes, ports and the service account
3. Install ADAudit Plus and run it as a Windows service
4. Sign in and connect your domain
5. Add the servers and workstations you want to audit

What are the system requirements for ADAudit Plus?

ADAudit Plus runs on a Windows computer in the domain you want to audit, ideally a dedicated Windows Server machine. ManageEngine's minimum is a 2.4 GHz processor with 4 cores, 8 GB of RAM and 50 GB of disk space, and the recommended specification is a 3 GHz processor with 8 cores, 16 GB of RAM and 100 GB of disk space.

What hardware does the ADAudit Plus server need?

ManageEngine recommends installing ADAudit Plus on a dedicated Windows Server with 8 cores, 16 GB of RAM and 100 GB of disk space, and suggests 16 cores and 32 GB of RAM for the best performance. Plan for 200 GB of disk space if you will use the AD Backup and Recovery add-on for around 100,000 users.

Database disk use grows with the number of events collected and with your archive settings. ManageEngine suggests running ADAudit Plus for a month, then checking real usage under Admin > Disk space analysis before planning long-term storage.

Which versions of Windows can run ADAudit Plus?

ADAudit Plus can be installed on Windows Server 2025, 2022, 2019, 2016, 2012 R2 and 2012, and on Windows 11 and Windows 10. ManageEngine also lists older versions that Microsoft no longer supports, such as Windows Server 2008 R2 and Windows 7, but a new deployment should use a Windows Server release that Microsoft still supports.

The web console runs in Google Chrome, Microsoft Edge or Mozilla Firefox, at a screen resolution of 1024 x 768 or higher.

Which databases does ADAudit Plus support?

ADAudit Plus ships with a bundled PostgreSQL database, which it uses by default and which needs no separate installation. Organizations that prefer Microsoft SQL Server can run ADAudit Plus on SQL Server 2014, 2016, 2017, 2019, 2022 or 2025, and ManageEngine publishes steps for moving an existing installation from PostgreSQL to SQL Server.

Which systems can ADAudit Plus audit?

ADAudit Plus audits on-premises Active Directory (2008 and later), Microsoft Entra ID (formerly Azure AD), AWS Managed Microsoft AD, AD Federation Services and AD Certificate Services, as well as Windows servers, Windows and macOS workstations, Windows file servers and a wide range of NAS devices. The base licence covers domain controllers, and the other sources are licensed as add-ons, so you only license what you audit.

• Windows servers: Windows Server 2008 and later.
• Workstations: Windows XP and later, and macOS Catalina 10.15 and later.
• Windows file servers: Windows File Server 2008 and later, including failover file clusters with SAN storage.
• NAS and cloud file storage: NetApp (Data ONTAP 7.2 and later, clustered Data ONTAP 8.2.1 and later), Dell EMC Celerra, VNX, VNXe, Unity and Isilon, Dell PowerScale, PowerStore and Unity XT, Synology DSM 5.0 and later, Hitachi NAS 13.2 and later, Huawei OceanStor, QNAP, Nutanix Files, CTERA Edge Filers (series 7), Qumulo Core 6.2.2 and later, Amazon FSx for Windows, Amazon FSx for NetApp ONTAP, and Azure Files.
• Cloud platforms: attack surface analysis for Microsoft Azure, Amazon Web Services and Google Cloud Platform.

See the ADAudit Plus product page for editions and add-on licensing in Canada.

What do I need to configure before installing ADAudit Plus?

Before ADAudit Plus can report on activity, Windows has to record the right events. That means enabling audit policies on the computers you want to audit, turning on object-level auditing for Active Directory objects and file shares, making the security event log large enough, opening the ports ADAudit Plus uses, and choosing the account ADAudit Plus will run under.

How do I configure audit policies for ADAudit Plus?

Audit policies tell Windows which categories of security events to record, and ADAudit Plus can only report on events that Windows has logged. Set them through Group Policy: the Default Domain Controllers Policy for domain controllers, and GPOs linked to the member servers, file servers and workstations you plan to audit. ManageEngine recommends advanced audit policies on Windows Server 2008, Windows 7 and later, because they record activity more precisely with less event noise.

What is object-level auditing (SACL), and when is it needed?

Object-level auditing uses a system access control list (SACL) on a specific object, such as an Active Directory container or a file share, to tell Windows to log access to that object. ADAudit Plus needs SACLs for Active Directory and Group Policy auditing, for file server and NAS auditing, and for file integrity monitoring; audit policies alone are enough for member servers and workstations.

Can ADAudit Plus configure audit policies automatically?

Yes. When you give ADAudit Plus Domain Admin credentials, or a service account with the delegated rights ManageEngine lists, it can apply the required audit policies for you from the web console under Domain Settings > Audit Policy: Configure. Some organizations still apply the policies by hand so that every Group Policy change goes through their own change process, and ManageEngine documents both methods.

What security log size should I set for ADAudit Plus?

Set the Windows security log to overwrite events as needed, and make it large enough to hold at least 12 hours of events so nothing is overwritten before ADAudit Plus collects it. ManageEngine's guidance for Windows Server 2008 and later is about 1 GB on domain controllers and about 4 GB on member and file servers, with 512 MB suggested for workstations.

Apply the setting in the same GPOs you use for audit policies, under Computer Configuration > Policies > Windows Settings > Security Settings > Event Log. Busy servers may need more than the suggested size to keep 12 hours of events.

Which ports does ADAudit Plus use?

By default the ADAudit Plus web console listens on port 8081 for HTTP and 8444 for HTTPS, and the computers you audit must accept RPC, NetBIOS and SMB traffic from the ADAudit Plus server so it can collect their Windows event logs. Domain controllers also need their LDAP, Global Catalog and Kerberos ports open to the ADAudit Plus server.

With Windows Firewall, the dynamic RPC range can be opened by enabling the three built-in Remote Event Log Management inbound rules (NP-In, RPC and RPC-EPMAP). To change the ADAudit Plus ports after installation, go to Admin > Connection > Change port in the console. Agents use different ports, covered below.

Does ADAudit Plus need Domain Admin rights?

No. ADAudit Plus starts auditing as soon as you give it Domain Admin credentials, but ManageEngine documents a least-privilege alternative: a dedicated service account with only the rights needed to read event logs and, if you want automatic setup, to configure audit policies. A least-privilege account limits the access held by the ADAudit Plus server.

ManageEngine's least-privilege setup involves:

• A dedicated domain user for ADAudit Plus, and a group containing every computer to be audited.
• A domain-level GPO that applies only to that group.
• The Manage auditing and security log user right for the service account.
• Membership in the Event Log Readers group, with access to the event log channels being collected.
• For automatic audit policy configuration, membership in Group Policy Creator Owners and permission to manage the group.

If you audit more than one domain, ManageEngine recommends a separate service account for each.

How do I install ADAudit Plus?

ADAudit Plus installs from a Windows installer (EXE), available through the Optrics free trial page or from ManageEngine. Run it on the server you prepared, accept the licence agreement, choose the installation folder, confirm the web console port (8081 by default) and finish the wizard; the installation itself takes a few minutes.

1. Run the installer and click Next in the setup wizard.
2. Accept the licence agreement.
3. Choose the installation folder, or keep the default under Program Files.
4. Confirm or change the web console port. The default is 8081.
5. Optionally register for ManageEngine technical support with a business email address. You can skip this step.
6. Start the installation and click Finish when it completes.

Should ADAudit Plus run as an application or a Windows service?

Run ADAudit Plus as a Windows service. Installed as an application, ADAudit Plus runs with the privileges of the signed-in user and event collection can stop when that user signs out; installed as a service, it keeps collecting events and runs under the service account set in the console's Domain Settings.

How do I install ADAudit Plus as a Windows service?

After the installer finishes, open an elevated Command Prompt in the ADAudit Plus bin folder and run InstallNTService.bat, or type ADAudit Plus in the Start menu search and run Install ADAudit Plus Service as administrator. Then start the service from Windows Services, where it is listed as ManageEngine ADAudit Plus.

How do I log in to ADAudit Plus for the first time?

Start ADAudit Plus, then open a browser and go to http://server-name:8081, using the name of the server where ADAudit Plus is installed and the port chosen during installation. Sign in with the default username and password, admin and admin, and change the password straight away.

• As a service: open Windows Services, right-click ManageEngine ADAudit Plus and choose Start.
• As an application: from the Start menu, open ADAudit Plus > Start ADAudit Plus server.

If Windows Firewall asks whether to allow the ADAudit Plus database server and Java components, allow access on the domain network so ADAudit Plus can start.

What is the default port and login for ADAudit Plus?

The ADAudit Plus web console uses port 8081 over HTTP by default, or 8444 over HTTPS, and the first sign-in uses the username admin with the password admin. Change the admin password at first sign-in, and consider switching the console to HTTPS using ManageEngine's SSL configuration guide.

What if ADAudit Plus doesn't find my domain automatically?

ADAudit Plus normally discovers the local domain and its domain controllers at first sign-in, after which you open Domain Settings, enter Domain Admin or service account credentials, and select the domain controllers to audit. If discovery fails, add the domain and its domain controllers manually from Domain Settings, following ManageEngine's manual configuration steps.

How do I add domain controllers, file servers and workstations to ADAudit Plus?

Once the domain is connected, add each type of source you have licensed from the ADAudit Plus web console: domain controllers, Windows file servers, Windows member servers, workstations, and cloud directories such as Microsoft Entra ID. Each source needs its audit policies in place first, and file servers also need object-level auditing, so finish the prerequisites for a source before adding it.

Can ADAudit Plus audit Microsoft Entra ID (Azure AD)?

Yes. ADAudit Plus can audit Microsoft Entra ID (formerly Azure AD) alongside on-premises Active Directory, so hybrid sign-ins and changes appear in one console. Entra ID tenants are licensed as an ADAudit Plus add-on in slabs of 1, 2, 3 or 5 tenants, and each tenant is connected from the console as a cloud directory.

When should I deploy ADAudit Plus agents?

ManageEngine recommends ADAudit Plus agents for large environments: networks spread across sites connected by WAN links, or with more than 1,000 workstations. The agent is a lightweight Windows service that collects and parses audit data on each computer and sends it to the ADAudit Plus server over HTTPS, so the audited computers do not need inbound RPC ports opened.

Agents send data on port 8555 by default, and cache events locally if the connection to the server drops. ManageEngine's agent guide covers deployment and a macOS agent is also available.

What happens when the ADAudit Plus 30-day trial ends?

A new ADAudit Plus installation runs as the Professional Edition for 30 days. When the trial ends it reverts to the Free Edition, which audits up to 25 workstations, unless a Standard or Professional Edition licence has been applied.

Optrics quotes both paid editions in Canadian dollars. The ADAudit Plus product page explains the difference between Standard and Professional and how the add-ons are licensed.

Does ADAudit Plus keep audit data in Canada?

ADAudit Plus is installed on a server you control, and the audit data it collects is stored in its own database on that server, either the bundled PostgreSQL database or your own SQL Server. If that server and your archive locations are in Canada, on your premises or in a Canadian data centre, the audit data ADAudit Plus stores stays in Canada.

That can make data residency questions under PIPEDA and provincial privacy laws easier to answer, but whether a deployment meets your obligations is a question for your privacy or legal advisers. Optrics can explain how ADAudit Plus stores and archives data; we do not provide legal advice.

Is there a PDF version of the ADAudit Plus Quick Start Guide?

Yes. Optrics hosts a copy of ManageEngine's ADAudit Plus Quick Start Guide as a PDF, identical to the version ManageEngine publishes as of September 2026. It covers the same steps as this page, which adds current system requirements, port lists and security log sizes from ManageEngine's online documentation, plus notes for Canadian organizations.

Download the Quick Start Guide PDF from ManageEngine, 417 KB