Active Directory

Use this page to collect audit events from on-premises Active Directory domain controllers in NeQter. If your environment has no Active Directory domain, skip this workflow. Microsoft Entra ID cloud activity is configured through the Microsoft Office 365 input.

Windows must generate the audit events, and the NeQter agent must collect their event IDs. Enabling one part does not automatically configure the other.

Agent

1. Install the current NeQter agent on each domain controller whose events you need. Obtain the installer and deployment instructions from NeQter Support.
2. In Hosts → Agents, confirm that each controller is reporting and belongs to the intended group.
3. Open the Groups view, select Edit group, and choose Logs → Windows.
4. Enable Winlog. Select Choose event IDs and review the events required for your audit policy. Use the category controls, search, or supported custom IDs to make the selection.
5. Select Save in the event-ID picker, then Save in the group editor. The picker alone does not commit the group configuration.

The Windows group editor controls which information agents collect. This example is an unsaved draft; the Windows audit policy is configured separately.

See Configure collection under Logs for the complete event-ID workflow.

GPO

Have the administrator responsible for Active Directory review the audit policy and its scope before applying it.

1. Open Group Policy Management. Create a clearly named GPO for the intended controllers, or review an existing approved audit-policy GPO. Microsoft documents creating, editing, and linking GPOs.
2. Link the GPO to the OU containing the intended domain-controller computer accounts. Check its security filtering: the target computers need Read and Apply Group Policy permissions. A user group alone does not select the computers that receive computer audit settings. See Group Policy scope.
3. Review the relevant settings under Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Select the subcategories and success/failure auditing needed for your events, using Microsoft’s advanced audit-policy reference.
4. For directory-object changes, review the objects’ auditing entries as well. Audit Directory Service Changes depends on matching system access control lists (SACLs), and these events are generated on domain controllers. See Microsoft’s Directory Service Changes guidance.

If NeQter Support supplies a current NeQter_AD GPO backup, review it before using Import Settings on your intended GPO. Back up any existing settings first and follow the package’s instructions. Import the supplied backup, not a backup of a newly created empty GPO. Importing settings does not replace reviewing links, filtering, and the resulting scope. Do not use Enforced as a routine collection requirement.

Apply and verify

On a target controller, apply the approved computer policy with an elevated command prompt:

gpupdate /target:computer /force

This reapplies computer policy; it is not a blanket instruction to restart every server. Follow any processing or restart requirement reported for your policy. See Microsoft’s gpupdate reference.

Review the effective audit settings with:

auditpol /get /category:*

Microsoft documents this read-only inspection in auditpol get.

Generate an approved test action, record its time, and confirm the event in the controller’s Event Viewer → Windows Logs → Security. Then locate the same host, event ID, and time in Discover. Repeat verification on each controller in scope; a single correctly scoped GPO can cover multiple controllers.

If the event is absent locally, review the effective Windows policy and applicable SACL. If it exists locally but not in NeQter, check agent reporting, group membership, Winlog selection, and the Discover time range. Once collection works, enable the relevant Windows dashboards under Settings → Dashboards.