Additional privileges required

Grant the user Read permission over the SYSVOL folder

Read permission over the SYSVOL folder is needed for GPO Settings change auditing.

Note: By default, all Authenticated Users have read permission over the sysvol folder, if the "ADAudit Plus" user does not, the Read permission has to be provided by following the steps listed below.

Navigate to the sysvol folder (C:\Windows\SYSVOL\sysvol) → Right click → Properties → Sharing → Advanced sharing → Permissions → Add the "ADAudit Plus" user → Provide Share Read permission.

Grant the user Full control over the product installation folder:

Full control over the product installation folder is needed for ADAudit Plus to write in the database.

• Log in to the computer where ADAudit Plus is installed with Domain Admin privileges → Locate the product installation folder → Right click → Properties → Security → Edit → Add the "ADAudit Plus" user and provide full control.

Grant the user Full control over ADAudit Plus' archive folder

Full control over the archive folder is needed for storing and retrieving archived data from the database.

Note: By default, the Archive folder is stored in the installation folder (Installation_folder\ManageEngine\ADAudit Plus\archive). If the Archive folder is saved elsewhere, Full control permissions needs to be provided by following the steps listed below.

• To find out the location of the Archive Folder: Open ADAudit Plus → Admin → Archive Events → Scroll down to see the location.



• Log in to target computer with Domain Admin privileges → Locate the folder → Right click on the folder → Properties → Security → Edit → Add the ADAudit Plus User → Provide NTFS Full control permission.
• If the archive folder is a shared folder, go to the Sharing tab → Advanced Sharing… → Permissions → Add the ADAudit Plus User → Provide Full control permission.

Grant the user Full control over all ADAudit Plus Scheduled Reports folders

Full control over a Scheduled Reports folder is needed for saving the scheduled report in the specified location.

Note: By default, the Schedule Reports folder is stored in the installation folder (<Installation_folder>\ManageEngine\ADAudit Plus). If the Schedule Reports folder is saved elsewhere, NTFS Full control permission needs to be provided by following the steps listed below.

• To find out the location of a Scheduled Reports Folder: Open ADAudit Plus → Admin → Schedule Reports → Modify Schedule Report → Scroll down to see the location.
• Log in to target computer with Domain Admin privileges → Locate the folder → Right click on folder → Properties → Security → Edit → Add the ADAudit Plus User → Provide NTFS Full control permission.
• Repeat the steps on all Schedule Reports folders.

Grant the user Read and Execute permission over all ADAudit Plus' Alert Script folders

Read and Execute permissions on a alert script folder is needed for executing script files once an alert gets triggered.

Note: By default, the Alert Scripts folder is stored in the installation folder (<Installation_folder>\ManageEngine\ADAudit Plus). If the Alerts Script folder is saved elsewhere, NTFS Read and Execute permission needs to be provided by following the steps listed below.

• To find out the location of a Folder: Open ADAudit Plus → Configuration → Modify Alert Profile → Scroll down to see the location.
• Log in to target computer with Domain Admin privileges → Locate the folder → Right click on folder → Properties → Security → Edit → Add the ADAudit Plus User → Provide NTFS Read and Execute permissions.
• Repeat the steps on all Alert Script folders.

Grant the user DCOM and WMI permissions

DCOM and WMI permissions are needed for WMI mode of event collection and for RSoP data to be shown for Domain Controllers, Windows member servers and workstations.

• To grant the user DCOM and WMI permissions, follow these steps.