ManageEngine ADAudit Plus
Cloud security monitoring and analytics software
Security information and event management (SIEM) software
Log analysis software
Network detection and response (NDR) software
User and entity behavior analytics (UEBA) software
Cloud security software
System security software
DevSecOps software
Network security software
User threat prevention software
- Features
- Ease of use
- Ease of management
- Quality of support
- Affordability
- Market presence
Take the quiz to check if ManageEngine ADAudit Plus and its alternatives fit your requirements.
$595 per year
Free TrialFree version
Small
Medium
Large
- Education and training
- Banking and insurance
- Public sector and nonprofit organizations
What is ManageEngine ADAudit Plus
ManageEngine ADAudit Plus is an on-premises and cloud-deployable auditing and reporting tool focused on Microsoft Active Directory, Azure AD, Windows file servers, and related identity infrastructure. It collects and correlates directory and server activity logs to support security monitoring, compliance reporting, and investigations into user and administrator actions. Typical users include IT security teams, Windows/AD administrators, and compliance teams that need change tracking, log search, and alerting around identity and file access events. The product differentiates by its AD-centric coverage (change auditing, logon activity, GPO and object changes) and packaged compliance reports rather than broad, multi-source SIEM coverage.
Deep AD change auditing
The product provides detailed tracking of Active Directory object and policy changes, including who made a change, what changed, and when it occurred. It supports auditing across common AD areas such as users, groups, OUs, and Group Policy Objects. This AD-first focus can reduce setup effort compared with general-purpose platforms when the primary requirement is identity change visibility.
Packaged compliance reporting
ADAudit Plus includes prebuilt reports and alert templates aligned to common audit needs around privileged activity, account management, and logon behavior. These reports help teams produce evidence for internal controls and external audits without building custom dashboards from scratch. For organizations with Windows-centric environments, this can shorten time to operational reporting.
Alerting for risky behaviors
The product supports real-time alerts for events such as repeated failed logons, account lockouts, privilege changes, and suspicious administrative actions. It can notify via email and integrate with ticketing or workflow processes depending on configuration. This enables near-real-time monitoring for identity-related threats without deploying a full SIEM stack.
Limited SIEM breadth
ADAudit Plus is primarily optimized for AD, Windows, and file server auditing rather than broad ingestion across diverse cloud services, endpoints, and network telemetry. Organizations seeking centralized correlation across many log sources may need additional tooling or integrations. This can create gaps for use cases that require enterprise-wide detection engineering and cross-domain analytics.
Not full NDR platform
While it can surface identity-related indicators that are relevant to network incidents, it does not provide native packet-level visibility, network sensor deployment, or network traffic analytics typical of dedicated NDR tools. Detection is largely driven by directory and server event logs. Teams looking for lateral movement detection based on network behavior may need complementary products.
Operational tuning required
Alert quality depends on careful configuration of thresholds, exclusions, and role-based access to reports. In environments with high authentication volume or frequent administrative changes, default alerting can generate noise. Ongoing tuning and log retention planning are typically required to keep investigations efficient and storage predictable.
Plan & Pricing
| Plan | Price | Key features & notes |
|---|---|---|
| Free (Free Edition) | $0 — Free edition, never expires | Audit and collect data across up to 25 Workstations; generate reports from data collected during evaluation; no fresh data populated after 30-day trial except for Workstations. |
| Standard | Starts at US$595 per year (example: 2 Domain Controllers) | All Free features + reports & alerts on event-log data collected from licensed components (Domain Controllers, Azure AD tenants, Windows servers, Workstations, Windows file servers, NAS). Licensed per-server. Add-ons available (file servers, NAS, Windows servers, workstations, Azure AD tenants). 24x5 live technical support. |
| Professional | Starts at US$945 per year (example: 2 Domain Controllers) | All Standard features + account lockout analysis, AD permissions change auditing, GPO settings change tracking, DNS & AD schema change auditing, new/old value auditing for AD object attributes, support for MS SQL backend, and other advanced AD auditing features. |
Additional published pricing slabs and add-ons (annual subscription fees) from the vendor's official pricing page:
-
Active Directory Audit (Domain Controllers) — Annual subscription fee (Standard / Professional):
- 2 Domain Controllers — US$595 / US$945
- 5 Domain Controllers — US$1,195 / US$1,795
- 10 Domain Controllers — US$2,145 / US$3,495
- 15 Domain Controllers — US$3,395 / US$5,095
- 20 Domain Controllers — US$4,395 / US$6,595 (More than 20 DCs: contact sales for personalized quote)
-
Azure AD audit — Annual subscription fee:
- 1 Azure AD tenant — US$995
- 2 Azure AD tenants — US$1,695
- 3 Azure AD tenants — US$2,295
- 5 Azure AD tenants — US$3,495 (More than 5 tenants: contact sales)
-
Windows File Servers — Annual subscription fee:
- 2 Windows File Servers — US$495
- 5 Windows File Servers — US$1,045
- 10 Windows File Servers — US$1,995
- 15 Windows File Servers — US$2,845
- 20 Windows File Servers — US$3,595 (More than 20: contact sales)
-
NAS File Servers — Annual subscription fee (per listed NAS types):
- 1 NAS file server — US$595
- 2 NAS file servers — US$995
- 3 NAS file servers — US$1,395
- 5 NAS file servers — US$2,195 (More than 5: contact sales)
-
Windows Servers — Annual subscription fee:
- 5 Windows Servers — US$345
- 10 Windows Servers — US$595
- 20 Windows Servers — US$945
- 50 Windows Servers — US$1,995
- 100 Windows Servers — US$3,295 (More than 100: contact sales)
-
Workstations — Annual subscription fee:
- 100 Workstations — US$245
- 250 Workstations — US$595
- 500 Workstations — US$945
- 1000 Workstations — US$1,795 (More than 1000: contact sales)
-
AD Backup and Recovery (add-on) — Annual subscription fee:
- 250 Users — US$195
- 500 Users — US$295
- 1000 Users — US$495
- 2000 Users — US$995
- 3000 Users — US$1,445
- 5000 Users — US$2,245 (More than 5000 users: contact sales)
Notes & purchase details (vendor site):
- ADAudit Plus is licensed per-server (Domain Controllers, Azure AD tenants, file servers, Windows member servers, Workstations) rather than per-user.
- Vendor publishes "pricing starts at" values and multiple predefined slabs; for requirements outside listed slabs, ManageEngine directs customers to request a customized quote or contact sales.
- A 30-day fully functional trial is offered; after 30 days the install reverts to the Free edition unless a paid license is purchased.
- Vendor store links are provided on the pricing page for direct "Buy Now" actions and quotes.
Seller details
Zoho Corporation
Chennai, Tamil Nadu, India
1996
Private
https://www.zoho.com/
https://x.com/zoho
https://www.linkedin.com/company/zoho/
