Active Administrator - Audit events not showing up in Active Administrator Console
After installing the DC (Domain Controller) Agents on your domain controllers, you may notice the audit events are not showing up in the Active Administrator Console | Auditing tab. Please follow these steps to locate the cause.
There could be several causes.
Open Active Directory Users and Computers on a DC and trigger an event that you are expecting to be audited (such as creating or deleting a user account). Then, open the Event Viewer on that DC and look in the Security Log. Does an audit record for that event show up here?
If the event does show up in the Security Log, then there is a problem with the agent connection to the database. Please move on to step 2.
Open the Active Administrator Server Management | Collection Agents (Agent Management tab in version 6.5 and higher) tab. If all DC’s don’t have an “Activated” status, and/or the last event is not current, please refresh the DC’s. Verify that the agent(s) is configured with the proper database logon information, and that the account used is in the AA_Admin group. This group is either local on the SQL server, or global in Active Directory Users container, depending on what was selected when the database was created.
If the agent settings are correct but there are still no events recorded in the Active Administrator console | Auditing tab, go to the DC’s and open the Application Log in the Event Viewer. Are there any errors associated with Active Administrator? Also check the Application log on the SQL server for errors with regard to Active Administrator.