Change Auditor for Active Directory 7.3


	NOTE: A Change Auditor Logon Activity license is required to capture the sign-in events. A Change Auditor for Active Directory license is required to capture the configuration changes events.

To capture these events, you must:

•

Create an Active Directory Federation Services template.

•

Add this template to an agent configuration.

•

Assign the agent configuration to agents.

This chapter includes a description of the Active Directory Federation Services auditing pages in the Administration Tasks tab, the procedure for creating and working with Active Directory Federation Services auditing templates.

Active Directory Federation Services Auditing page

The Active Directory Federation Services Auditing page is displayed when Active Directory Federation Services is selected from the Auditing task list in the navigation pane of the Administration Tasks page. From this page you can start the Active Directory Federation Services Auditing wizard to monitor sign-in activity and configuration changes. You can also edit existing templates, disable/enable templates and remove templates that are no longer being used.

The auditing page contains an expandable view of all the templates that have been previously defined. To add a new template to the list, use the Add tool bar button.


	NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

Once added, the following information is provided for the template:

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.

Sign-Ins

Displays whether the auditing of sign-in activity is enabled or disabled.

Configuration changes

Displays whether the auditing of configuration changes is enabled or disabled.

Active Directory Federation Services auditing templates

To create an auditing template:

Open the Administration Tasks page.

Click Auditing.

Select Active Directory Federation Services in the Auditing task list.

Click Add to open the Active Directory Federation Services Auditing wizard.

Enter a name for the auditing template.

Select the activity to audit. The options include sign-ins and configuration changes.

Click Finish or Finish and Assign to Agent Configuration to assign the template to an agent configuration.

On the Configuration Setup dialog, use one of the following methods to assign this template to an agent configuration:

•

Select the newly created template and drag and drop it onto a configuration in the Configuration list.

•

Select a configuration from the Configuration list and ‘drag and drop’ it onto the newly created template.

•

Select a configuration, then select the newly created template, right-click and select Assign.

•

Select a configuration, then select the newly created template, click in the corresponding Assigned cell and click Yes.

If this configuration is not assigned to any agents, you will need to assign it to agents on each computer where Active Directory Federation Services is deployed.

•

On the Agent Configuration page, select one or more agents from the agent list and click Assign.

•

On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.

•

On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.


	NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.

To modify an auditing template:

On the Active Directory Federation Services Auditing page, select the required template and click Edit. This opens the Active Directory Federation Services Auditing wizard where you can modify the current settings.

Click Finish to save your changes and return to the Active Directory Federation Services Auditing page.

To disable and enable an auditing template:

Disabling a template temporarily stops auditing without having to remove the auditing template.

On the Active Directory Federation Services Auditing page, place your cursor in the Status cell for the auditing template to disable, click the arrow control, and select Disabled.

-OR-

Right-click the template to disable and select Disable.

The entry in the Status column for the template changes to ‘Disabled’.

To enable the auditing template, select Enable in the Status cell.

To delete an auditing template:

On the Active Directory Federation Services Auditing page, select the required template and click Delete | Delete Template.