# Security Dashboard

**Purpose:** Access review screen for the platform and the directory behind it. Four panels covering account composition, Active Directory conditions, devices still running default credentials, and raw collection logs.

![Visual One Intelligence Security Dashboard showing the User Information donut, Active Directory Audit bar chart, Devices with Default Password panel, and collection Logs panel](https://visualoneintelligence.com/wp-content/uploads/2026/08/voi-docs-security-dashboard.png)

## When to use it

- Run a periodic user access review without scripting against a domain controller
- Quantify how much of the account population is privileged, stale, or exempt from password rotation
- Find devices still authenticating with vendor default credentials
- Diagnose whether a device's numbers are stale because collection failed or because the environment changed

## Key areas and metrics

| Panel | Visualization | What it carries |
| --- | --- | --- |
| User Information | Donut, legend below chart | Account population split into five categories |
| Active Directory Audit | Horizontal bar chart, x-axis is number of users | Seven directory conditions, one series per audited domain, with an export control in the panel header |
| Devices with Default Password | Plain list | Collected devices still on vendor default credentials, by model and serial |
| Logs | Device selector plus scrollable log | Timestamped collection entries with severity, site, collector type, commands issued, and sample counts |

## User Information categories

| Category | What it means |
| --- | --- |
| `Normal Users` | Standard accounts with nothing flagged against them |
| `New Users` | Recently created accounts |
| `Stale Users` | Accounts that have not logged in for over a month |
| `Users w/ Expired Password` | Accounts whose password has passed its expiry |
| `Privileged Users` | Accounts carrying elevated rights |

## Active Directory Audit conditions

- **Normal Users.** The baseline population, for scale against everything below it.
- **Locked Users.** Accounts currently locked out.
- **Privilege Groups.** Count of groups conferring elevated rights.
- **Inherited Privilege Users.** Accounts holding privilege through group membership rather than direct assignment. These are the ones manual reviews miss, because nobody granted them anything explicitly.
- **Users with Expired Passwords.** Accounts past password expiry.
- **Users w/ Passwords That Do Not Expire.** Accounts exempt from rotation policy. Frequently service accounts, and frequently more numerous than expected.
- **Explicitly Privileged Users.** Accounts granted privilege directly.

## Common actions

- **Read privileged against normal on the donut.** A privileged share in double digits is usually privilege that accumulated rather than privilege that was granted, and it is the finding most likely to surface in an audit.
- **Compare explicit against inherited privilege.** A small explicit count next to a large inherited count means privilege is arriving through group nesting, so the remediation is a group review rather than an account review.
- **Work the default-password list to zero.** Every entry is an active exposure on a device the platform can already reach.
- **Select a device in Logs when a report looks wrong.** The log shows whether collection ran, whether it authenticated, which commands it issued, and how much came back.

## Tips

> The Devices with Default Password panel should be empty. Any entry is the highest-priority item on the screen. Do not screenshot or export that panel outside the team responsible for remediation, because it names a reachable device and the credential state protecting it.

> The Logs panel is often faster than any other screen for separating a collection failure from a genuine change in the environment. Check it before escalating a suspicious trend.

## Related screens

[Administrative Report](https://visualoneintelligence.com/docs/security-administrative-report/) holds the change and login history that evidences remediation of anything found here. [Storage Health Alerts](https://visualoneintelligence.com/docs/storage-health-alerts/) and [Virtual Health Alerts](https://visualoneintelligence.com/docs/virtual-health-alerts/) cover operational conditions rather than identity ones.

---

Source: https://visualoneintelligence.com/docs/security-dashboard/