How To Use the Audit Module

Open the Audit Page

Click Audit in the left navigation panel. The Audit page opens with a master/detail layout:

• Left panel (top) — Profiles list showing name, enabled report count, and last-run time
• Left panel (bottom) — Reports-in-profile tree preview, grouped by category with counts and bold category headers
• Right panel — Full-height result tabs area

Built-in profiles are marked with a ★ star prefix. The panel divider is draggable so you can adjust the left/right split to your preference. The page remembers how you size its panels, and Reset Layout in the Tools group of the Audit ribbon puts them back New in 7.6.

Run an Audit

Select a profile in the profiles list, then double-click it or click the Run button on the toolbar. You can also right-click a profile and choose Run from the context menu.

The audit runner executes up to 4 reports in parallel, providing 3–4× faster execution compared to sequential processing. A progress bar and status label show real-time progress. Result tabs appear as each report finishes, with color-coded status icons:

• • Green — report completed with results
• • Gray — report completed but returned no data
• • Red — report encountered an error

Result grids open with the Find Panel and Auto-Filter Row enabled for immediate searching and filtering.

You can cancel a running audit at any time by clicking the Stop button. Reports that have already completed will remain in their tabs.

Run or View a Single Report New in 7.5.1.3

You don't have to run an entire profile to look at one report. Click a single report in the profile's reports-in-profile list to open just that one:

• If the report has already been run in this session, its existing result opens instantly — no re-query.
• If it hasn't been run yet, only that one report runs, instead of the whole profile.

Run Audit is unchanged — it still executes the complete profile as before. This is purely a faster path when you want to check or re-check one specific finding without hunting through tabs.

Security Findings and Readiness Checks: Pass or Fail New in 7.6.3

A security finding or a platform readiness check (accounts, computers) lists the objects that match what it looks for, so an empty result is a pass. On the Audit page its tab says so, with its severity — “[High] Kerberoastable Privileged Accounts - Fail (2)”, “… - Pass” or “… - could not run” — with an amber mark for Fail, green for Pass and red when it could not run, and the profile's reports list shows the severity, then the result. A finding that cannot read what it needs fails and says why, so a missing permission never looks like a clean result.

Run on the AD Reports page, the same reports end the status line with “Fail: 2 objects match” or “Pass: nothing matches”, under a line saying what a finding is and is not. In the audit workbook the Run Summary gains Finding and Severity columns, and a Findings sheet says why each finding matters, how to fix it and where to read more.

See What Changed Since the Last Run New in 7.6.3

Run a profile again and the Audit page says what moved since it last ran that profile on the same domain. Each report in the profile's list adds it: “[Critical] Replication (DCSync) Rights Beyond the Defaults - Fail (2) - 1 fixed, 1 new”, “Pwd Never Expires - no change”, or “first run”. Hover a result tab for the full counts, the date compared with and the objects that were fixed. Running one report from the list counts as a run of it, and Export All's workbook carries the same in its Since last run columns.

A scheduled run's workbook says what changed since the last scheduled run: the Run Summary's Since last run column reads, for a finding, “1 fixed, 2 still open, 0 new since 22 Oct 2026 14:05” and, for any other report, “1 no longer listed, 2 still listed, 0 new”; the first run says there is nothing to compare yet. The Findings sheet shows the same for each finding, names the objects that were fixed, and lists the 18 techniques of the Five Eyes guide Detecting and mitigating Active Directory compromises with the findings of the run that check each. Scheduled runs keep their own comparison, so a run on the page never hides a change from the next scheduled run.

Create and Edit Audit Profiles

To create a new profile, click the New button on the toolbar. To modify an existing profile, select it and click Edit, or right-click and choose Edit from the context menu.

In the Profile Editor you can:

• Set the profile Name and Description
• Browse the full report tree organized by category (Users, Groups, Computers, GPO, OU, Contacts)
• Check or uncheck individual reports to include or exclude them — checking a report type such as User, or a category, checks every report under it, and its box shows whether all, some or none of them are checked New in 7.6.3
• Review all selected reports in the Selected Reports panel on the right
• Use the Reset to Default button on built-in profiles to restore the original report selection

Click Save to save the profile. To delete a custom profile, right-click and choose Delete. Built-in profiles (marked with ★) cannot be deleted.

Filter by Compliance Framework New in 7.6

The Compliance drop-down in the New/Edit Audit Profile window narrows the report list to the reports relevant to PCI-DSS, SOC 2, ISO 27001, HIPAA, NIST 800-53, NIS2 or DORA, so you can assemble an evidence set without reading through several hundred reports. The filter never changes your selection: reports it hides stay selected, still appear under Selected Reports, and are still saved. A line under the two lists says how many reports the framework has and, when the filter is hiding something you picked, how many.

The report list's Compliance column shows each report's frameworks. To change them, select the report and click Edit Tags... — add a framework, remove one, or clear them all. Customized tags are marked with an asterisk (*), and Use Built-In Default puts a report back to the tags that ship. Only your changes are stored, so the shipped tags keep improving for every report you have not touched.

Schedule an Audit Profile

Any audit profile can be scheduled to run unattended and email the results. Click the Schedule button on the Audit toolbar (or right-click a profile and choose Schedule).

The Schedule dialog lets you configure:

• Recurrence — Once, Daily, Weekly or Monthly, or every hour or every 2, 3, 4, 6, 8 or 12 hours New in 7.6.3; a line under it says when the schedule first runs and how often after that
• Start date and time (defaults to now)
• Export folder — where the multi-sheet Excel workbook will be saved
• Email recipients — email addresses, subject, and body text

Every N hours counts real time: on the day daylight saving time begins or ends, an hourly schedule runs 23 or 25 times and the other hourly choices move by an hour on the clock. A run that comes due while the previous one is still queued or running is skipped, and Job History says why. A Monthly schedule runs on its start's day, or on the last day of a shorter month; one saved before 7.6.3 runs on the first weekday of the month until you open it and save it again.

Visual Indicators

Scheduled profiles display visual markers on the Audit page:

• A clock icon prefix on the profile name in the list
• A toolbar label showing recurrence type and next run time (e.g., “🕐 Daily 09:15 · Next: in 2d”, or “Every 2 hours · Next: in 45m”)
• Hover the label for full details including next absolute time and email recipients

Scheduler Calendar Integration

Audit schedules appear on the Scheduler Calendar in purple and are labeled as "Audit: {profile name}". Double-clicking an audit appointment on the calendar redirects you to the Audit page for editing.

Review Results and Close Tabs

After the audit completes, click any result tab to review the report data in a grid with search and auto-filter capabilities.

To clean up the results area, use the Close dropdown button:

• Close All — removes all result tabs
• Close Empty Reports — removes only tabs with zero results (gray icons)
• Close Error Reports — removes only tabs that encountered errors (red icons)

Export Audit Results

Use the Export dropdown button to export your audit results:

• Export All Reports to Excel (multi-sheet) — the first item: every report on the page in one .xlsx workbook, opening with a Run Summary sheet
• Export to Excel (XLSX)..., Export to Clean Excel (styled)... and Export to CSV... — the report in the active tab
• Export to PDF..., HTML, MHT, RTF, Text and Print Preview... — the report in the active tab

All exports include a timestamp suffix in the filename (e.g., SecurityAudit_20260408_143052.xlsx) for easy organization and versioning.

The Run Summary Sheet New in 7.6.1

The multi-sheet workbook — the one Export All Reports to Excel (multi-sheet) writes, and the one a scheduled audit profile e-mails — opens with a Run Summary sheet: a line such as “22 reports: 15 with rows, 6 with no rows, 1 failed.”, then one row per report with its Category, Outcome (Success, Empty or Failed), Rows, a link to its Sheet, and the Error for a report that failed.

The report sheets follow in the profile's order, one for each report that found rows, named after the report. A report that found nothing and one that failed no longer simply go missing from the workbook — the summary says which is which.

New in 7.6.3 For a security finding or a readiness check the Run Summary adds its Finding result (Pass, Fail or Unknown — it did not finish) and Severity, and every report gets a Since last run column (see step 3). A Findings sheet follows, with each finding's Severity, Result, Objects, Since last run, Fixed since last run, Why it matters, How to fix and References, and the list of Five Eyes guide techniques with the findings that checked each.

Build a Compliance Evidence Pack New in 7.6

The Evidence Pack button on the Audit ribbon turns your scheduled runs into a dated PDF or Excel document for any period — what ran, coverage against PCI-DSS, SOC 2, ISO 27001, HIPAA, NIST 800-53, NIS2 and DORA including the relevant reports that did not run, and what changed between runs. See Build a Compliance Evidence Pack.