Chat now with support
Chat mit Support

Change Auditor for Active Directory Queries 7.0.3 - User Guide

AD Query settings

From the Agent Configuration page on the Administration Tasks tab you can define how to optimize the Active Directory query auditing process, summarizing similar operations from the same client.

Use the AD Query tab at the top of the Configuration Setup dialog to define the settings for summarizing similar operations from the same client and only record the summary in the Active Directory query event:

Discard query results less than nn records
This setting instructs Change Auditor to only generate an event if an Active Directory query returns more or equal to the number of results specified.
The default value is 0; therefore Change Auditor will generate an event even if the Active Directory query returns no results.
Discard queries taking less than nn milliseconds
This setting instructs Change Auditor to only generate an event if the Active Directory query takes longer than or equal to the specified number of milliseconds.
The default value is 20 milliseconds.
Discard duplicate queries occurring within nn minutes
This setting defines how long Active Directory query events are to be ‘held’ to determine if duplicates have occurred before they are forwarded to the Change Auditor client.
The default is 15 minutes meaning Change Auditor will gather Active Directory query events and hold them in a queue to determine if any duplicate queries have been generated during the specified interval. Change Auditor will then forward the AD Query event to the client specifying how many occurrences of that query were performed during the 15 minute interval.
AD Query auditing enabled
This check box is selected by default which enables AD Query auditing. Clearing this check box disables all AD Query auditing on the agents using the agent configuration selected in the left pane, which is often times desired for busy agents.
To set the AD Query settings:
1
Open the Administration Tasks tab.
2
Click Configuration.
3
Select Agent in the Configuration task list to display the Agent Configuration page.
4
Click Configurations.
5
On the Configuration Setup dialog, select an agent configuration from the left pane.
6
Open the AD Query tab and set the Active Directory query event settings as defined above.
7
Once you have set these settings, click OK to save your selections, close the dialog and return to the Agent Configuration page.
8
On the Agent Configuration page, select the agents assigned to the selected agent configuration and click Refresh Configuration to ensure the agent are using the latest configuration.
 
* 
NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

 

Active Directory Query Searches/Reports

•
Introduction
•
Run AD Query reports
•
Create custom AD Query search

Introduction

You can search, report and alert on LDAP-enabled applications and how they use Active Directory.

Run AD Query reports

Running the All AD Query Events report will retrieve all the AD Query events captured for Active Directory® containers being audited.

To run the All AD Query Events report:
1
Launch the Change Auditor client and open the Searches tab.
2
In the explorer view (left pane), expand the Shared | Built-in | All Events folder.
3
Locate and double-click All AD Query Events in the right pane.
4
A new Search Results page appears displaying the AD Query events captured over the last seven days.

In addition to the All AD Query Events report, Change Auditor for Active Directory Queries ships with some additional Active Directory Query reports, which are located in the AD Query folder in the explorer view.

To run a more specific AD Query report:
1
Open the Searches tab.
2
In the explorer view, expand the Shared | Built-in | AD Query folder.
3
Locate and double-click one of the AD Query searches in the right-hand pane.
4
This will display a new Search Results page displaying the AD Query events that meet the search criteria defined in the selected search.
* 
NOTE: By default, the AD Query reports display additional LDAP details (such as, LDAP Occurrences, LDAP Results, etc.) in the Search Results page.
Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen