Chat now with support
Chat with Support

Change Auditor 7.3 - PowerShell User Guide

Working with searches

Searches (both built-in and private) allow you to view valuable information based on activity captured by Change Auditor.

When using the commands, consider the following:

The following commands are available to manage searches:

Use this command to run a search.

-Connection

A connection obtained by using the Connect-CAClient command.

-Search

The search to run. Use Get-CASearches to find the PSCASearchInfo object required to identify the search.

-StartTime (Optional)

The start time for the events that will be retrieved. By default this is the start time defined in the search.

-EndTime (Optional)

The end time for the events that will be retrieved. By default this is the start time defined in the search.

-Limit (Optional)

The maximum number of records to retrieve and display. By default this is the limit defined in the search.

$connection = Connect-CAClient -InstallationName 'DEFAULT"

$search = Get-CASearches $connection | ? {$_.Name -eq "All Events"}

Invoke-CASearch -Connection $connection -Search $search -limit 10

 

Use this command to view information on all available searches and identify a search info object that is required for some other commands.

-Connection

A connection obtained by using the Connect-CAClient command.

Get-CASearches $connection

Get-CASearches $connection | ? {$_.Name -eq "All AD Queries in the last 30 days"}

Use this command to obtain the search definition from an existing search. The search definition is XML that can be modified and used to create a search.

-Connection

A connection obtained by using the Connect-CAClient command.

- Search

The search info object obtained from the Get-CASearches command.

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

[xml]$xmlString = Get-CASearches $connection | ? {$_.Name –eq “All Events”} | Get-CASearchDefinition $connection

$xmlString.Save(“C:\definitions\All Events.xml”)

Use this command to update the search name, default folder, set the limit of a public or private search, or the path and subsystem for an imported .csv file of a list of directory objects.

-Connection

A connection obtained by using the Connect-CAClient command.

-Search

The search info object obtained from the Get-CASearches command.

-Name

Specifies a new name for the search.

-DefaultFolderPath

Specifies a new default folder path for the search.

-Limit

Specifies a new limit for the search.

-PassThru (Optional)

A switch that specifies to return the updated search after the command runs.

-Subsytem

The subsystem to update. The ability to import a .csv file with a list of objects is available for Active Directory, Exchange, and Group Policy.

-Path

Path to the .csv file to import.

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ?{$_.Name –eq “All Owner Mailbox Events”}

Set-CASearchProperties $connection -Search $search -Name "NewName"
-DefaultFolderPath "C:\PATH\MYSEARCH" -Limit 1000

$connection=Connect-CAClient -InstallationName 'Default'

$search = Get-CASearches $connection | ? {$_.Name -eq "All My Events"}

Set-CASearchProperties $connection -Search $search -Subsystem "Active Directory" -Path "C:\MyCSVObjectList.csv"

Copy-CASearch

Use this command to copy a search in the installation.

-Connection

A connection obtained by using the Connect-CAClient command.

-Search

The search info object obtained from the Get-CASearches command.

-IsPublic (Optional)

An optional switch that specifies if the search is public. The default is private.

-UserSid

An optional parameter that is used (when –IsPublic is not used) to specify the SID of the user that owns the directory where the copy of the search is placed.

-Path

A parameter that specifies a path where the copy is to be placed. The default is the root folder of the user/public folder specified with
–UserSid /-IsPublic.

-Name (Optional)

An optional parameter that specifies a new name for the copy of the search.

-PassThru (Optional)

A switch that specifies to return the updated search after the command runs.

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ? {$_.Name –eq “New Search for Employee”}

Copy-CASearch –Connection $connection –Search $search –UserSid S-1-5-21-3623811015-3361044348-30300820-1013 –Path Private\Searches\New –Name “All My Events” -PassThru

Use this command to create a search in the installation.

-Connection

A connection obtained by using the Connect-CAClient command.

-XmlSearchDefinition

An XML string or object that represents a search definition.

-IsPublic

A switch that specifies if the search is public. The default is private.

-UserSid

A parameter that is used (when –IsPublic is not used) to specify the SID of the user who owns the new search.

-Path

A parameter that specifies a path where the new search will be placed. The default is the root folder of the user/public folder specified with –UserSid /-IsPublic.

-Name

A parameter that specifies a new name for the search.

-PassThru (Optional)

A switch that specifies to return the new search after the command runs.

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$searchDefinition = Get-Content C:\Users\Admin\Documents\MySearchDefinition.xml

Add-CASearch –Connection $connection –XmlSearchDefinition $searchDefinition
–IsPublic –Path Shared\AllSearches\New –Name “All events in the past 23 hours”
-PassThru

Use this command to move a search from one folder path to another in the installation.

-Connection

A connection obtained by using the Connect-CAClient command.

-IsPublic

A switch that specifies if the search is public. The default is private.

-UserSid

A parameter that is used (when –IsPublic is not used) to specify the SID of the user who owns the new search.

-Path

A parameter that specifies the path where the search will be placed. The default is the root folder of the user/public folder specified with –UserSid /-IsPublic.

-Search

The search info object obtained from the Get-CASearches command.

-PassThru (Optional)

A switch that specifies to return the updated search after the command runs.

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ? {$_.Name –eq “All AD Queries in the last 30 days”}

Move-CASearch $connection –Search $search –UserSid S-1-5-21-3623811015-3361044348-30300820-1013 –Path “Shared\Skype”

Use this command to remove a public or private search from the installation.

-Connection

A connection obtained by using the Connect-CAClient command.

-Search

The search info object obtained from the Get-CASearches command.

-Force (Optional)

A parameter that removes the prompt before a search is removed.

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ? {$_.Name –eq “All Exchange Admin Events”}

Remove-CASearch $connection –Search $search

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

$search = Get-CASearches $connection | ? {$_.OwnerSid –eq “S-1-5-21-3623811015-3361044348-30300820-1013”} | ? {$_.FolderPath –eq “Security\Internal\Searches”} | ? {$_.Name –eq “All Search Events”}

Remove-CASearch $connection –Search $search

Use this command to create a search folder in the installation.

-Connection

A connection obtained by using the Connect-CAClient command.

-IsPublic

A switch that specifies if the search is public. The default is private.

-UserSid

A parameter that is used (when –IsPublic is not used) to specify the SID of the user who owns the new folder.

-Path

A parameter that specifies the path to create. The default is the root folder of the user/public folder specified with –UserSid /-IsPublic.

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

Add-CASearchFolder –Connection $connection –IsPublic –Path Shared\Searches\New

Use this command to remove a public or private folder from the installation.

-Connection

A connection obtained by using the Connect-CAClient command.

-IsPublic

A switch that specifies the folder being removed is public.

-UserSid

A parameter that is used if –IsPublic is not specified to speci-fy the SID of the user that owns the private folder being removed.

-Path

A parameter that specifies the path to the folder to remove. The default is the root folder of the user/public folder specified with
–UserSid /-IsPublic.

-Force (Optional)

An optional parameter that removes the prompt before a search is removed.

$connection = Connect-CAClient –InstallationName ‘DEFAULT’

Remove-CASearchFolder $connection –IsPublic –Path Shared\Miscellaneous\OldSearches

Managing Active Directory Database auditing

Change Auditor allows you to monitor the Active Directory database (NTDS.dit) file for possible unauthorized access attempts.

Extraction of this file could lead to parsing of usernames and passwords resulting in a security breach. The ability to audit changes to this file reduces the risk of the user account information from being accessed and tampered with by unwanted processes or users.

Managing Active Directory database auditing is available through the following PowerShell commands:

Use this command to create an Active Directory Database auditing template.

-Connection

A connection obtained by using the Connect-CAClient command.

-TemplateName

The template name.

-Disabled (Optional)

Set to true or false to enable or disable the template.

-ExcludedProcesses (Optional)

The list of processes to exclude from auditing. The default is none.

New-CAADDatabaseTemplate -Connection $connection -TemplateName $template
-ExcludeProcess $excludeProcess -Disabled false

Use this command to see all the Active Directory Database auditing templates available within your installation.

-Connection

A connection obtained by using the Connect-CAClient command.

-Id (Optional)

The template GUID.

Get-CAADDatabaseTemplates -Connection $connection

Use this command to delete an Active Directory Database auditing template.

-Connection

A connection obtained by using the Connect-CAClient command.

-Template

The CAADDatabaseTemplate object to remove. Obtain the template objects using the Get-CAADDatabaseTemplate command and filter to select the object to remove.

-Force (Optional)

Removes template without prompting for a confirmation. The default is false.

Remove-CAADDatabaseTemplate -Connection $connection -Template $removeTemplate

Use this command to modify an Active Directory Database auditing template.

-Connection

A connection obtained by using the Connect-CAClient command.

-TemplateName

The template name.

-Template

The PSCAProtectionTemplate object to update.

Obtain the template objects using the Get-CAADDatabaseTemplate command and filter to select the object to remove.

-Disabled (Optional)

Set to true or false to enable or disable the template.

-ExcludedProcesses (Optional)

The list of processes to exclude from auditing. The default is none.

Set-CAADDatabaseTemplate -Connection $connection -template $template -templatename "Name" -ExcludeProcess $excludeProcess -Disabled false

Working with Active Directory Database protection templates

Change Auditor allows you to protect the Active Directory database (NTDS.dit) file for possible unauthorized access attempts.

The following commands are available to manage Active Directory Database protection:

Use this command to create an Active Directory Database protection template.

-Connection

A connection obtained by using the Connect-CAClient command.

-TemplateName

The template name.

-Disabled (Optional)

Set to true or false to enable or disable the template.

-ExcludedProcesses (Optional)

The list of processes to exclude from protectoin. The default is none.

New-CAADDProtectionTemplate -Connection $connection -TemplateName TemplateSample

Use this command to modify an Active Directory Database protection template.

-Connection

A connection obtained by using the Connect-CAClient command.

-Template

The CAADDProtectionTemplate object to edit. Obtain the template objects using the Get-CAADDProtectionTemplates command and filter to select the object to remove.

-TemplateName (Optional)

The template name.

-Disabled (Optional)

Set to true or false to enable or disable the template.

-ExcludedProcesses (Optional)

The list of processes to exclude from protectoin. The default is none.

set-caaddprotectiontemplate -connection $connection -template $template -templatename "templatesample"

Use this command to see all the Active Directory Database protection templates that have been created.

-Connection

A connection obtained by using the Connect-CAClient command.

-ID (Optional)

GUID for a specific template.

Get-CAADDProtectionTemplates -Connection $connection

Use this command to remove an Active Directory Database protection template.

-Connection

A connection obtained by using the Connect-CAClient command.

-Template

The PSCAProtectionTemplate object to remove.

Obtain the template objects using the Get-CAADDatabaseTemplate command and filter to select the object to remove.

-Force (Optional)

Removes the template without providing confirmation.

Remove-CAADProtectionTemplate -Connection $connection -Template $template

 

 

 

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating