Audit and reports
Applies to client 2.0.x and later. For auditors, tenant admins.
Every elevation attempt from an enrolled device, in both flows, ends up in Audit: which device, which user, what, when, why, approved by whom and for how long. Auditors and tenant admins can read it.
What is recorded
Section titled “What is recorded”| Field | Meaning |
|---|---|
| Time | When the attempt started (UTC) |
| Device, user | Hostname and the Windows account (with its SID) |
| Flow | A = pre-approved, B = on demand |
| Kind | exe, ps1, msi, lnk (a shortcut, with the shortcut’s path) or sandbox |
| Target, arguments | The file and the arguments it ran with |
| SHA-256, publisher | The file’s hash and signer, when read |
| Decision | Allowed, Denied, Pending, Approved, Rejected, Expired or Unlicensed |
| Reason code | Why it was denied (see Troubleshooting) |
| User reason | What the user typed |
| Matched by | list:<name>, rule:<name> or any, plus the Entra group when a group granted it |
| Approval mode, approved by | Auto or Manual; the approver and when |
| Duration | From start to the end of the elevated process; “running” while it runs |
| User-writable folder | The file was in a folder the user can write to |
| Confirmation | For “any application” matches: the answer at the secure-desktop prompt |
Sandbox runs carry the switches that were on and the time limit. Records are evidence: the portal accepts a record once, completes it once with its end, and never changes who, what or why afterwards. The duration is computed by the portal from start and end.
The same attempts are also written on the device to the Windows Application log, source AdminExplorer, also when the device is not enrolled.
Filters and export
Section titled “Filters and export”- Records: filter by device, user name (exact), decision, kind (including sandbox runs) and a date range, and page through the results.
- Export this page as CSV saves the rows on screen.
- A software change linked to an elevation opens the matching audit record directly.
Summaries
Section titled “Summaries”- Per device and Per user: attempts, elevations, last elevation and total elevated time, plus sandbox runs and total sandbox time counted apart.
- The default window is the last 30 days; at most 90 days. Very large windows cover the most recent records only and say so (“truncated”).
Approvals
Section titled “Approvals”Approvals shows pending requests and the history with who decided and their comment. Approvers and tenant admins can decide; approval mails go to at most 5 approvers per request.
Retention
Section titled “Retention”| Data | Kept |
|---|---|
| Audit records | 400 days |
| Approval requests | 90 days |
| Software change history | 400 days |
| Device event log | As configured in Windows on the device |
Records the device could not send yet are kept in a protected local queue (bounded at 50 MB or 10,000 records, oldest first out) and sent when the portal is reachable. Uninstalling the client deletes records that were not sent yet; an upgrade keeps them. Deleting the tenant deletes all of its records.
Related guides
Section titled “Related guides”AdminExplorer documentation, published by Circle of Bytes ApS. Customers sign in at portal.adminexplorer.circleofbytes.com.