Change Auditor for Active Directory 7.1.1


	NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see the Change Auditor User Guide.

The ADAM (AD LDS) protection templates defined are global settings and apply to all ADAM instances associated with a Change Auditor agent.


	NOTE: If you are planning to use multiple ADAM (AD LDS) Protection templates, see the Change Auditor Technical Insight Guide for more information about how multiple protection templates are evaluated.


	NOTE: You can also open the protection wizard from the event details pane. Simply open the Search Results tab, select an event, and click the Protect Object button.

To create an ADAM Protection template:

Open the Administration Tasks tab.

Click Protection.

Select ADAM (AD LDS) in the Protection task list to open the ADAM (AD LDS) protection page.

Click Add to open the ADAM (AD LDS) Protection wizard to specify the objects to protect.

On the first page of the wizard, select the ADAM (AD LDS) instance from which to choose protected objects. The list displays the ADAM (AD LDS) instances in your environment. It only shows instances running on computers with a Change Auditor agent installed.


	NOTE: If credentials are needed to connect to the selected ADAM (AD LDS) instance, a credentials required dialog is displayed prompting you to enter the appropriate credentials.

On the next page of the wizard, enter a name for the template.

Use the Browse or Search pages to locate and select the object to protect. Click Add to add the selected object to the list. Repeat this step to add additional objects.

By default, the create, modify attributes, and delete operations are selected; however, you can change this by using the drop-down arrow in the Denied Operations cell in the list box and selecting or clearing the different operations.

By default, the scope of coverage is for This object only; however, you can change this by using the drop-down arrow in the Scope cell of the list box and selecting one of the other two options:

•

This object and child objects only

•

This object and all child objects

On the next page of the wizard, select the attributes to be protected. By default, all attributes for the object will be protected. However, if you want to protect individual attributes instead, select one of the following options to activate the attributes list:

•

Only Selected

•

All EXCEPT Selected

From the attributes list box on the left, select the individual attributes to be included in this protection template and click Add to move them to the Selected Attributes list.

If you want to specify individual users or groups that are to be allowed to make changes to the protected object, click Next to display the Select Accounts Allowed (Not Allowed) to Access Protected Objects page.

Use the Browse or Search pages to locate and select the user or group accounts to exclude from this protection template. Click Add to add the accounts.

Click Finish to save the protection template, close the wizard and return to the ADAM (AD LDS) Protection page.


	NOTE: The Allow option is selected by default indicating that the selected users or groups will be allowed to change the protected objects. However, you can select the Deny option at the top of this page and select individual users or groups that are NOT allowed to change the protected objects. When using the Deny option, you are allowing all users and groups to change the protected objects except for those selected on this page.

To modify a protection template:

On the ADAM (AD LDS) protection page, select the template and click Edit.

The ADAM (AD LDS) Protection wizard opens where you can modify the current list of objects, and the attribute selection and the override accounts selected.

Click Finish to save your changes and return to the ADAM (AD LDS) protection page.

To disable a protection template:

Disabling a template allows you to temporarily stop protection for the specified objects without having to remove the protection template.

On the ADAM (AD LDS) protection page, place your cursor in the Status cell for the protection template, click the arrow control, and select Disabled.

The entry in the Status column for the template changes to ‘Disabled’.

To re-enable the protection template, use the Enable option in the Status cell.

To disable an object’s protection within a protection template:

On the ADAM (AD LDS) protection page, place your cursor in the Status cell for the object to be disabled, click the arrow control and select Disabled

The entry in the Status column for the object changes to ‘Disabled’.

To re-enable an object’s protection, use the Enable option in the Status cell.


	NOTE: If you disable all the objects in a protection template, the template itself will become disabled. Similarly, when you re-enable an object in the protection template, the template will automatically be re-enabled.

To delete a protection template:

On the ADAM (AD LDS) protection page, select the template and click Delete | Delete Template.

•

Right-click the template and click Delete.

Click Yes to confirm.

To delete an object from a protection template:

On the ADAM (AD LDS) Protection page, select the object and click Delete | Delete Object.

ADAM Protection Wizard


	NOTE: When you delete the last object in a protect template, the entire protection template will be deleted.

The ADAM (AD LDS) Protection wizard displays when you click Add or Edit on the ADAM (AD LDS) protection page. From the wizard, you can define the ADAM objects and attributes to protect from unauthorized modifications.


	NOTE: You can also open the protection wizard from the event details pane. Simply open the Search Results tab, select an event, and click the Protect Object button.

The following table provides a description of the available fields and controls:

Table 9. ADAM (AD LDS) Protection wizard

Select ADAM (AD LDS) instance page: The first page of the wizard displays a list of ADAM (AD LDS) instances running a Change Auditor agent in your environment.

ADAM (AD LDS) Instances

This list includes the following information about each ADAM (AD LDS) instance listed:

•

Agent - this column displays the name of the agent where each ADAM (AD LDS) instance resides.

•

Instance Name - this column displays the name of the ADAM (AD LDS) instances displayed.

•

Instance Port - this column displays the port number assigned to each of the ADAM (AD LDS) instances displayed.

Select an instance from this list. When prompted, enter the user credentials to be used to access the selected instance.

NOTE: If you have multiple ADAM (AD LDS) instances with replicating application partitions, there is no need to configure a protection template for each instance. Change Auditor will automatically send the protection configuration to each machine that is hosting an instance. You must have an agent installed on each instance host.

Select ADAM (AD LDS) Objects to Protect page: On this page, enter a name for the template and select the objects to be protected.

Template Name

Enter a descriptive name for the protection template.

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the Active Directory object(s) to be protected.

After you have selected an object, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to search your environment to locate an Active Directory object to be protected.

After you have selected an object, click Add to add it to the list.

Options page

Use the Options page to modify the search options or ADAM instance used to retrieve directory objects.

Object list

The list box across the bottom of the page displays the objects selected for protection. Use the buttons located above this list box to add and remove objects.

•

Add - Select an object in the Browse or Search page and add it to the Object list.

•

Remove - Select an entry in the Object list and remove it from the template.

Denied Operations

By default, the create, modify attributes and delete operations are selected. To change this setting, use the drop-down arrow in the Denied Operations cell and select or clear operations.

Scope

By default, the scope of coverage is set to This object only. To change this setting, use the drop-down menu in the Scope cell to select a different scope.

•

This object only

•

This object and child objects only

•

This object and all child objects

NOTE: Child objects do not refer to nested groups when protecting a group object.

(Optional) Select Attributes to Protect page: By default all attributes for the selected objects will be protected. However, you can use this page to protect individual attributes or to exclude individual attributes from protection.

All Attributes

This option is selected by default indicating that all attributes will be protected from unauthorized access.

Only Selected

Select this option to protect individual attributes. Selecting this option will activate the list boxes on this page allowing you to select the individual attributes to be protected.

All EXCEPT Selected

Select this option to protect all attributes EXCEPT those selected. Selecting this option will activate the list boxes on this page allowing you to select the individual attributes that are not to be protected.

Attributes list

The list box to the left displays all of the available attributes which may be selected for inclusion in the protection template.

NOTE: This list box is not enabled when the All Attributes option is selected.

Add

Use to move the attributes selected in the Attributes list over to the Selected Attributes list.

Remove

Use to move the attributes selected in the Selected Attributes list back over to the Attributes list.

Selected Attributes list

The list box to the right displays the attributes to be included in the protection template.

NOTE: This list box is not enabled when All Attributes are selected.

(Optional) Select Accounts Allowed (Not Allowed) to Access Protected Objects page

By default all users and groups are prevented from changing the ADAM (AD LDS) objects selected for protection. However, you can specify individual users or groups that are allowed (not allowed) to change the protected objects.

NOTE: Management actions performed by excluded accounts are audited but not prevented.

Allow (Default)

Indicates that the users and groups selected on this page ate the only accounts allowed to change the protected objects.

Use the Browse or Search page to select the user or group accounts.

Deny

Select this if you want to allow all users and groups to change the protected objects except for those selected on this page.

Use the Browse or Search page to select the user or group accounts.

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the users or groups that will be allowed (not allowed) to change the protected objects.

After you have selected an account, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to locate the users or groups that will be allowed (not allowed) to change the protected objects.

After you have selected an account, click Add to add it to the list.

Options page

Use to modify the search options used to retrieve directory objects.

Override Accounts list

The list box across the bottom of the page displays the user and group account(s) that will be allowed (not allowed) to make changes to the protected objects selected on the previous page of the wizard. Use the buttons located above this list box to add and remove accounts.

•

Add - Select an account in the Browse or Search page to add it to the Override Accounts list.

•

Remove - Select an entry in the Override Accounts list to remove it.

Active Directory Database protection

When configured, Change Auditor prevents copying and other tampering attempts on the Active Directory database (NTDS.dit) file. Extraction of this file could lead to parsing of usernames and passwords resulting in a security breach.

This section includes a description of the Active Directory Database protection pages in the Administration Tasks tab, the procedure for creating an Active Directory Database protection template and description of the protection wizard used to define Active Directory Database protection template.

Active Directory Database protection page

This page displays when you select Active Directory Database from the Protection task list in the navigation pane of the Administration Tasks tab. From here, you can start the Active Directory Database protection wizard to define your Active Directory Database protection template to protect your Active Directory database from unauthorized access. You can also edit existing templates, disable and enable templates, and remove templates that are no longer being used.

The Active Directory Database protection page contains an expandable view of all previously defined Active Directory Database protection templates. To add new template, use the Add button.


	NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

Once added, the following information is provided for each template:

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the template is enabled or disabled. To enable and disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.

Exempt Process Filter

Displays a list of processes which bypass Active Directory database protection.