Chat now with support
Chat mit Support

Change Auditor for Active Directory 7.3 - User Guide

Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane

Removing deployed Change Auditor for Active Directory/Active Roles integration scripts

You can use the Active Roles console to manually remove previously deployed integration scripts.

To remove integration scripts:
1
Open Configuration | Policies | Administration.
2
Right-click Change Auditor Integration Policy, select Policy Scope.
3
Remove Active Directory in the object list.
4
Delete Change Auditor Integration Policy.
5
Right-click Change Auditor Integration Deprovision Policy, select Policy Scope.
6
Remove Active Directory in the object list.
7
Delete Change Auditor Integration Deprovision Policy.
If you are using...
 

Active Roles 6.9

Active Roles 7.0

Active Roles 7.1
•
Navigate to Configuration | Script Modules and delete Quest Change Auditor Integration Script.

Troubleshooting Tips

Not receiving events from Active Roles

To diagnose problems with receiving events from Active Roles, check the ‘Active Roles Admin Service’ event log on the Active Roles server.

Initiator information missing in events

Some events do not provide the initiator account information. This could be caused by the following:

•
Manually created objects
Computer objects that are manually created do not capture the initiator account information of the user that initiated the change.
•
Protected and unprotected objects
If an object is protected and unprotected through the Active Roles console, the initiator account will be missing from Change Auditor for Active Directory.
The Protect/Unprotect operation in Active Roles is not a direct Active Directory attribute operation. When you protect/unprotect an object, you actually add an Access Template link to the security descriptor in Active Directory. Because of this, the initiator account information is not captured for events related to protect/unprotect events.
•
In some scenarios, the following events do not capture the initiator account information when made through the Active Roles console:
•
User password changed
•
User password changed by non-owner
•
User must change password at next logon option changed

Quest GPOADmin Integration

GPOADmin uses a proxy account (service account) to connect and change Active Directory objects and group policies. In past releases, Change Auditor for Active Directory only captured the service account name in the event details for changes initiated through GPOADmin. GPOADmin now integrates with Change Auditor for Active Directory and allows the name of the user who initiated the GPOADmin operation and comments to display in the Change Auditor for Active Directory client.

* 
NOTE: GPOADmin only sends initiator and comment information to Change Auditor for Active Directory for the following operations:
•
GPO deployment
•
Working copy check-in
•
Working copy check-out

This appendix covers the following topics for GPOADmin integrations:

•
Requirements
•
GPOADmin and Change Auditor integration process
•
Client components added to Change Auditor for Active Directory
•
Troubleshooting tips

Requirements

Refer to the Release Notes for the list of minimum system requirements.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen