Audit evidence that says what it could not see.
Tracemark already knows your directory, your devices and every change made in its console. Governance & Audit turns that into controls, sealed evidence and reports, and never counts a gap as a pass.
Everything an auditor asks for, in one place.
Access rights, change history, device posture and the console's own trail already sit in one database. Answering an audit question becomes a lookup instead of a project.
Measured controls
Each control is measured from live data and reports what it covered, what passed, what failed and what it could not see. A coverage gap makes a control partial.
Sealed evidence packs
A frozen record of the controls and their evidence, sealed with a SHA-256 hash. A pack that has been edited fails its own check, and its export says so.
Access reviews
Campaigns in which owners keep or revoke access. Evidence is frozen when the campaign starts, and items nobody decided close as undecided.
Admin activity
Every console change and every Active Directory change, with the account that made it.
Password compliance
Every enabled account, administrators included, checked against the password policy that governs it.
Reports
A catalogue of reports with schedules, delivery history and CSV, XLSX and PDF output.
Device posture
Patch, encryption and software state come from the same agent that manages the devices.
Sensitive data at rest
Regulated data found by discovery, grouped by category and tied to the controls it puts at risk.
Your administrators leave a trail too.
IT staff hold the most power and are usually the least watched. Tracemark records every change made in its console and reads the domain controller's Security log, so a change in Active Directory arrives with the name of the person who made it.
- Directory change ledger. Users, groups, OUs and group policies compared on every sync. Privileged groups are recognised by their identifier, so renaming one does not hide it.
- The actor behind each change. Group membership changes, password resets, logons, scheduled tasks and PowerShell activity from the DC Security log.
- Working rules. Prohibit an operation, require a written reason, require a second administrator's approval, or allow it only inside a change window.
- No self-approval. The person who asked for an approval cannot decide their own request.
- Alerts on the console's own trail, so a risky admin action raises an alarm like any other.
Every account against its own policy.
One verdict per account, administrators first. Each row names the policy that applies, whether the domain default or a fine-grained policy, and explains every exemption. It works from directory attributes and events and never reads passwords or password hashes.
- The ways out of a policy. Passwords that never expire, accounts that need no password, reversible encryption and fine-grained policies weaker than the default.
- Overdue passwords on enabled accounts, past the maximum age of their own policy.
- Behaviour as well as settings. History cycling and administrators resetting their own password are flagged.
- Unknown stays unknown. When a governing policy cannot be read, the account shows as not measured.
- CSV for the auditor, with the governing policy on every row.
A role sees only what it can use.
Permissions are granted per resource and per action, and every protected action is checked on the server. Menus, pages and buttons outside a role are not greyed out. They are not there.
- Built-in roles for full administrators, policy owners, forensic investigators, read-only viewers and auditors.
- An auditor sees everything and certifies nothing. Reading the trail is a separate right from producing evidence, deciding a review or arming an alert.
- Custom roles for teams such as a helpdesk that only needs remote support.
- Direct links respect the role. A page the role cannot open sends the person to their first allowed page.
- Sign-in controls with multi-factor authentication and single sign-on.
An empty report that explains itself.
Every report run carries a verdict and its coverage, written into the file itself.
Data
The rows are there, and so is the share of machines that contributed to them.
No data
Everything was measured and nothing was found. The empty table is a real answer.
No coverage
Nothing reported, so the report says so instead of showing zero. This is never presented as a clean result.
No skip-when-empty
There is deliberately no option to suppress an empty report. An empty report that explains itself is the most useful thing a schedule can send.
Delivery history
Every scheduled attempt is recorded. A failed delivery raises an event instead of failing silently.
Published links
Shareable links expire after seven days, are stored only as a hash and log every download.
From live data to a pack your auditor can open.
How an evidence pack is produced, and how it stays trustworthy after it leaves the console.
Collect
Directory, devices, patches, encryption and console actions are already in Tracemark.
Measure
Each control reports passed, failed and not measured, with its coverage.
Seal
The pack is frozen and hashed. The tables behind it are sealed a day at a time.
Share
The auditor receives an expiring link that you can revoke at any time.
Repeat
Scheduled packs and control history answer "were we compliant last quarter".
What is included.
Governance & Audit is a set of modules over the same data. Each one is permission-gated, so an auditor can read everything without holding the keys.
Access rights, change history and control status, built from the data Tracemark already holds. A coverage gap makes a control partial. It never makes it a pass.
- Access findings: privileged, stale and never-used accounts
- Local administrators on machines, with how many machines reported
- Controls with history, risk acceptance and remediation links
- Hash-sealed evidence packs, scheduled and shared by expiring link
- Access review campaigns with evidence frozen at the start
- File audit on shares, with the user taken from the Security log
A complete view of what IT staff did, in the console and in Active Directory, with rules that apply before a risky change goes through.
- Every state-changing console action recorded
- Users, groups, OUs and group policies compared on each sync
- Actor, logons, scheduled tasks and PowerShell from the DC Security log
- Working rules: prohibit, reason, second approval, change window
- Periodic comparison of local administrator membership
- Alert rules on console actions
Whether each enabled account obeys the password policy that governs it, administrators listed first. Directory attributes and events only, never password hashes.
- The governing policy per account: domain default or fine-grained
- Never-expiring, not-required and reversible-encryption accounts
- Fine-grained policies weaker than the default
- Overdue and must-change passwords, smart-card accounts
- History cycling and self-resets by administrators
- Accounts whose policy cannot be read shown as not measured
A catalogue of ready reports across devices, risk and activity. One definition feeds the viewer, the export and the schedule, so the three always agree.
- Inventory, software, licences and hardware lifecycle
- Open vulnerabilities, missing updates and failed patch installs
- Security events and the administrative audit trail
- A verdict on every run: data, no data or no coverage
- CSV, XLSX and PDF, with coverage written into the file
- Daily, weekly and monthly schedules with full delivery history
Least privilege for the console. Each role carries resource and action grants, and every protected action is checked against them on the server.
- Built-in roles, including a read-only auditor
- Custom roles from fine-grained grants
- Producing evidence is a separate right from reading it
- Pages and actions outside a role are hidden entirely
- Multi-factor authentication for console sign-in
- Single sign-on with role mapping
Every console action, sign-in and forensic lookup in one searchable trail. Each entry is chained to the one before it, so a change to history shows when the chain is checked.
- Filter by who, what, which resource and when
- Chain verification from the console
- HMAC-signed export
- No route edits or deletes an entry
- Retention clean-up leaves the log alone
- Deleting a user cannot rewrite their past entries
Regulated data found by discovery, grouped by data category and tied to the controls it puts at risk, with a retention policy for the findings.
- Findings by data category
- A risk band per category
- Controls at risk for each category
- Evidence CSV
- Retention policy for findings
- One step to the findings in data discovery
Forward security events to the tools your team already watches. Each destination shows whether its transport is encrypted before you save it.
- Webhooks, with an optional shared secret
- Syslog over UDP, TCP or TLS
- Email through your own SMTP server
- Choose event types and a minimum severity
- Delivery and failure counts per destination
- Last error shown on the destination itself
Where each answer comes from.
| Source | What it shows | Collected by |
|---|---|---|
| Active Directory sync | Accounts, groups, OUs, group policies and password policies, and how they changed | Tracemark Deployer |
| DC Security log | Who made a directory change, logons, scheduled tasks and PowerShell activity | Tracemark Deployer |
| Endpoint agent | Local administrators, installed software, patches, encryption and device connections | Windows agent |
| File servers | Creates, changes, renames and deletes on audited shares, with the user | Agent on the server |
| Console | Every administrative action, sign-in and approval | Tracemark server |
Questions.
Do we need a separate audit or change-tracking product?
For the areas Tracemark covers, no. Directory objects, device posture, software history and console actions are already collected for other modules, and Governance & Audit reads the same data.
What does "not measured" mean?
Tracemark had no data for part of the estate, for example machines that never reported or a policy it could not read. Those gaps are shown beside the passes and failures and are never counted as passing.
Can an auditor use the console without changing anything?
Yes. The built-in Auditor role reads every control, pack, review and log entry, but cannot generate evidence, decide a review or arm an alert.
Does password compliance read password hashes?
No. It uses account attributes, password policy settings and directory events. Tracemark does not extract or compare password hashes.
Is there anything Tracemark cannot see?
Yes. Systems without a Tracemark agent or connector, such as hypervisors, storage appliances and cloud admin consoles, are outside its view. Reports state their coverage so this stays visible.
Works well with
See it on your own estate.
We measure a set of controls against your directory and devices and show where every piece of evidence comes from.