How to audit Active Directory Federation Services

Active Directory Federation Services(ADFS) makes authentication a seamless experience for users. ADFS helps at workplaces where employees need to access multiple third-party applications. ADFS helps integrate the authentication process between the Active Directory network and the third-party applications. With ADFS, users only have to sign in once into their network and that authenticates them for all the applications as well, for a period of time. However, this makes life difficult for network administrators who have to keep these passwords from getting into the wrong hands. If these passwords are compromised, it puts a whole host of application data at risk. Therefore, it becomes imperative to constantly monitor ADFS.

ADAudit Plus is an Active Directory auditing and reporting tool that keeps a close eye on all the events in the network. It has an exclusive set of ADFS reports, which is only a part of the over 200+ pre-packaged reports that are available in the console.

Here is a comparison on auditing ADFS using Windows PowerShell and ADAudit Plus.

Using Windows PowerShell

Identify the domain you want the information from.
Write the code. The sample cmdlet below lists all the associated ADFS properties. Add parameters to the script if needed. For example, the ExpandProperty parameter gives more detail about a particular property that is listed.
Compile the script.
Execute it in PowerShell.
The script will have to be modified accordingly if it needs to be exported in a different format.

In this case, the script needs no input. Simply execute Get-AdfsProperties to get PowerShell to list all the associated properties of the ADFS service in that domain.

To set the relevant properties, use Set-AdfsProperties cmdlet.

Using ADAudit Plus

In the ADAudit Plus console, find the Reports tab and click on ADFS Auditing. Under ADFS Auditing, there are reports on logon success, logon failures, extranet lockouts and so on.
Find the relevant domain and OU.
Click Export to export the report in the various formats listed in the console (CSV, PDF, HTML, CSVDE, XLSX)

Here is a sample report on Logon Success:

This report gives a list of successful logons with the relevant domain controller, IP address of the client machine and most importantly the third-party application they logged in to. This helps administrators trace any user who has logged in to any of the applications.

Here is another report on login failures:

Failed logon attempts should be viewed as potential security threats as it could have been attempted by persons trying to break into a network. This report gives the identity of the user, the IP address of the client machine and the reason for the failed logon.

The disadvantages of using Windows PowerShell to audit ADFS:

It will require multiple PowerShell scripts to do a complete audit.
Exporting the report in a different format would require re-writing parts of the script.
It is difficult to filter through all the data that PowerShell lists, while ADAudit Plus has clearly labeled reports, that make it easy for administrators to locate what they need.

ADAudit Plus has a user-friendly interface and generates audit reports with no scripting involved. It does not just list data, but processes data from multiple sources in Active Directory to deliver comprehensive reports in no time.

Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
US
By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.
Thanks!
Your download is in progress and it will be completed in just a few seconds! If you face any issues, download manually here.

Active Directory auditing

Windows file auditing

NAS device file auditing

Windows server auditing

Workstation auditing

Entra ID auditing

All features →

Help documents

Video zone

Webinars

Product brochures

Case studies

E-books

Awards zone

Study

How tos

Best practices

How to audit Active Directory Federation Services

Using Windows PowerShell

Using ADAudit Plus

Here is a sample report on Logon Success:

Here is another report on login failures:

Related Resources

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Identity and access management

Unified service management

Unified endpoint management and security

IT operations management and observability

Security information and event management

Advanced IT analytics

Low-code app development

Cloud solutions for enterprise IT

IT management for MSPs

Active Directory management Manage, track, and secure Active Directory

Identity governance and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service managementDeliver a consistent employee experience across business functions

Customer service managementBuild a one-stop portal for customers with efficient account management

IT asset managementCentralize and automate the complete IT asset life cycle

SIEM Spot, investigate, and neutralize security threats

Log and compliance managementGain deeper visibility into security events and ensure compliance

Security auditingAudit Active Directory, cloud platforms and files to enhance your security posture

Endpoint management and protection platform (UEM and EPP)Secure and manage endpoints to protect your IT assets effectively

Endpoint managementAchieve intelligent IT device management with zero user intervention

Endpoint securityDefend against threat actors with proactive and reactive measures

Full-stack observability and digital experience monitoringAchieve end-to-end visibility, proactive issue resolution, and enhanced security

Network and server performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident managementEfficiently manage and resolve IT incidents while ensuring transparency

DNS and DHCP managementOptimize IP address and domain management

Cloud cost managementRight-size and take control of your cloud costs

IT analyticsConnect to your IT applications and visualize all facets of your IT

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloudand hybrid infrastructure

Business applications for ITBoost productivity and improve team collaboration

Custom solution builderBuild tailor-made apps to automate operations at your organization

Solutions for MSPsGrow your MSP business with scalable and secure IT management solutions

How to audit Active Directory Federation Services

Using Windows PowerShell

Using ADAudit Plus

Here is a sample report on Logon Success:

Here is another report on login failures:

Related Resources

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service
managementDeliver a consistent employee experience across business functions

Customer service
managementBuild a one-stop portal for customers with efficient account management

IT asset
managementCentralize and automate the complete IT asset life cycle

Network and server
performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident
managementEfficiently manage and resolve IT incidents while ensuring transparency

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloud
and hybrid infrastructure