AD Logga fails with delegated service account in ARM

AD Logga reads Security event logs on your domain controllers and evaluates SACLs (audit entries) on AD objects. A Domain Admin account includes all required rights by default; a delegated service account must be explicitly granted these rights and audit permissions to allow AD Logga to read the necessary events.

The delegated AD Logga service account does not have all the required logon and auditing rights on the domain controllers and/or the required audit permissions (SACL) on the monitored AD objects. Event Log Readers membership alone can be insufficient in hardened environments.

Resolution 1: Grant required rights to the delegated AD Logga service account

Verify that the AD Logga service account has at least the following rights:

1. Group membership on domain controllers

   • Member of Event Log Readers on the domain controllers used by AD Logga.

   • (Alternatively, Domain Admins also have the required access, but this article focuses on delegation.)

2. User right: Manage auditing and security log (SeSecurityPrivilege)

   • In hardened environments, add the service account to a GPO that grants “Manage auditing and security log” (SeSecurityPrivilege) so it can work reliably with Security logs and SACL-related operations.

For detailed AD Logga and service account requirements, see:

• • ARM service account permissions

   

Resolution 2: Validate audit permissions (SACL) on AD objects

Ensure the audit permissions (SACL) for the monitored domain/objects are configured as described in the AD Logga documentation:

Minimum recommended SACL entry on the monitored domain:

• Principal: Everyone

• Type: All

• Apply to: This object and all descendant objects

• Permissions:

  • Write all properties

  • Delete

  • Delete subtree

  • Modify permissions

  • Create all child objects

  • Delete all child objects

For step-by-step guidance, see:

• Set audit permissions in the AD object SACLs

After applying the group membership, user right, and SACL configuration, restart AD Logga (or the ARM service) and retest with the delegated service account.