Is it possible to not install LEM agents on workstations and still get audit records from Domain controllers?

Question

With our current auditing solution, Log Logic, we are able to just have agents installed on servers and AD controllers which provide us with the audit information we require from workstations via the audit records on the Active Directory controllers. Is this possible in LEM or do I need to install agents to our workstations as well?

curtisi · Answer

The Agents read the logs that are on the machine they are installed on, so you'll only get events from the Domain Controllers.  Where the Domain Controllers are contacted by the workstations (ie, for machine or user authentication events) you should get those events in the DC logs, assuming you have an audit policy that generates events for that.  For events that only occur on the local machines, like disk full events on a workstation or an anti-virus process stopping, you have to have the Agent on the workstation for those events.

berriganp30 · Answer

How would I go about setting up LEM to read the audits from workstations from the AD controllers? Would much rather do it that way then spend licenses on each workstation.

curtisi · Answer

We've definitely seen customers who use the LEM as you describe, installing the Agent on key servers like Domain Controllers to gather information.  Putting the Agent on all your workstations will allow the LEM to do some more in-depth reporting, or course, and can also allow the LEM to do some magic with workstations, but if you're strapped for licenses what you describe is doable.