Overview

Auditing Windows workstations helps monitor and report on a user's logon and logoff information, their most productive hours, logon history details, and more. It helps monitor the usage of removable storage devices, instances of scheduled tasks, and process creation as well as termination. Monitor critical system, configuration, and program files for anomalous change events to ensure their integrity. Detect and respond to anomalous login activities that are indicative of malicious insiders by closely monitoring user login trends.

Benefits of Windows workstation auditing with ADAudit Plus

• Audit, monitor, and report on all users' local logon and logoff instances across Windows workstations.
• Measure your employees’ productivity by monitoring their average work hours, idle time, and more.
• Monitor user actions across terminal services to analyze remote login activities.
• Track critical process creation and termination events with details on who initiated the action and when.
• Track, record, and maintain an audit trail of all users’ login history details.
• Audit and report on the usage of removable storage such as USB devices.
• Monitor and report on Windows startup time, shutdown time, and the duration of each user's session on the workstation.
• Ensure file integrity by keeping track of changes made to system files, program files, and more.
• Gain instant visibility into changes made to your local administrator groups and user accounts, including creation, deletion, and account lockout activities.

Supported Windows workstation OS versions

ADAudit Plus can audit workstations running Windows 11, 10, 8, 7 (EOLed by Microsoft) and Vista (EOLed by Microsoft).