Chat now with support
Chat mit Support

Change Auditor 7.4 - Quick Start Guide

Group and filter data

Using the column headings in the data grids throughout the client, you can customize the content displayed by defining the sort order or sort criteria, moving or hiding columns. In addition, you can group data to create a collapsed view or filter the data to limit the data displayed in the grids to locate specific information.

To group data:
1
Select a column heading (the column heading will pop off the table) and drag that column heading to the space above the table. For example, use the left mouse button to click the Subsystem heading and drag that column heading to the space above the table.
2
Optionally, repeat this step to select additional headings to create a hierarchy of groupings.
This will collapse the table and display the groupings that can be expanded to view the detailed information that applies to that group.
3
To expand a group and display the individual events listed, click on the + sign to the left of the label.
4
When a grouping is in place, you can use the Pie Chart or Bar Graph icons, located at the top of the grid, to redisplay the data.
* 
NOTE: The pie chart and bar graph displays are only available when a single level grouping has been applied to the data grid.
5
In either of these views, use the Data Grid icon to redisplay the data in the grid format.
6
To remove a grouping, select the heading and drag it back down into the table area or right-click a group heading (in area above the grid) and select one of the remove commands.
To filter data:

Throughout the client, you will see a row of data filtering cells under the headings row in each of the data grids. These cells provide data filtering options which allow you to filter and sort the data displayed.

1
Place your cursor in one of the cells, and click Click here to filter data.
2
In the selected cell, enter the word or string of characters to be used to filter the data displayed. Filtering will take place as you type your entry.
3
By default, Change Auditor will use either the ‘starts with’ or ‘contains’ expression to filter the data. However, if you click the search criteria button, you can select a different expression.
4
To remove the filtering and return to the original data grid, click the Remove Filter button to the far left of the cells.
5
To remove the filtering of an individual cell, click the Remove Filter button to the right of that cell.

Create a Change Auditor events list

From the client, you can print or save the contents of the currently displayed page using the File | Print menu commands or the Print tool bar buttons. In addition to using the print feature, these procedures introduce some additional heading controls that can be used to customize the content being displayed.

To create an Excel spreadsheet of all Change Auditor events:
1
Open the Administration Tasks tab (View | Administration).
2
Click Auditing.
3
Select Audit Events under the Configuration task list to open the Audit Events page.
4
Optionally, use the heading controls to sort the list, resize or rearrange the columns. (Keep in mind, the print feature prints/saves whatever is displayed in the active Change Auditor page.)
•
To change the sort criteria, click on the column heading to be used for the sort criteria.
•
To resize a column, place your cursor on the boundary between column headings, click and hold the left mouse button dragging the column boundary to the desired size.
•
To move a column, use the left mouse button to click the heading to be moved. Drag the column heading to the desired location.
5
Click the arrow to the right of the Print tool bar button and select Print to File.
6
On the Save As dialog enter the following information:
•
Use the navigation pane (left pane) to select the location where the file is to be saved.
•
File name: Enter a name for the file. Default is Events Configuration.<extension>.
•
Save as type: Click the arrow control and select Excel files (*.xls) or Excel 2007 files (*.xlsx).
Click Save.
To create a PDF file of all Change Auditor for Exchange events:
1
Open the Audit Events page on the Administration Tasks tab.
2
Use the License Type column to filter the events list:
•
Place your cursor in the cell directly beneath the License Type heading.
•
Enter Exchange.
You now have an event list that only contains the Exchange events.
3
Optionally, use the heading controls to sort the list, resize or rearrange the columns.
* 
NOTE: Keep in mind, the print feature prints/saves whatever is displayed in the active Change Auditor page.
•
To change the sort criteria, click on the column heading to be used for the sort criteria.
•
To resize a column, place your cursor on the boundary between column headings, click and hold the left mouse button dragging the column boundary to the desired size.
•
To move a column, use the left mouse button to click the heading to be moved. Drag the column heading to the desired location.
4
Click the arrow to the right of the Print tool bar button and select Page Setup. On the Page Setup page, change the following settings:
•
Orientation: Landscape
•
Margins (inches): Left: 0.25 Right: 0.25
Click OK to save the page setup settings.
5
Select the Print | Print Preview option to preview the report. Click the x in the Print Preview tab to close the preview page.
6
Back on the Audit Events page, select the Print | Print to PDF option.
7
On the Save As dialog enter the following information:
•
Use the navigation pane (left pane) to select the location where the file is to be saved.
•
File name: Enter a name for the file. Default is Events Configuration.
•
Save as type: This field is pre-filled with PDF files (*.pdf).
Click Save.

Exclude accounts from auditing

Using account exclusions, you can define a list of trusted accounts which are to be excluded from the auditing process. This enables you to exclude events generated by accounts that make a large number of changes via scripting or by accounts which are trusted.

To use the account exclusion feature, you must first complete the following steps to define the user/computer accounts that can make changes without triggering an event in Change Auditor:

1
Open the Administration Tasks tab.
2
Click Auditing.
3
Select Excluded Accounts under the Auditing task list to open the Excluded Accounts Auditing page.
4
Click the Add tool bar button to launch the Excluded Accounts wizard which will step you through the process of creating an Excluded Accounts template.
•
On the first page of the wizard, enter a name for the template and optionally select the facilities/event classes to be excluded.
* 
NOTE: To include ALL event classes/facilities in this Excluded Accounts definition, leave the list box across the bottom of this page empty.
•
On the second page of the wizard, use the Browse or Search pages to locate and select the user or computer accounts that are to be excluded from Change Auditor auditing. Click the Add button to add these accounts to the list box at the bottom of this page.
5
To create the template and assign it to an agent configuration, expand the Finish button and select Finish and Assign to Agent Configuration.
6
On the Configuration Setup dialog select the agent configuration (right pane) to which the template is to be assigned and ‘drag and drop’ it onto the newly created template.
The Assigned cell for the template will change to Yes.
7
Click OK to save your selection, close the dialog and display the Agents Configuration page.
8
If this configuration is not assigned to any agents, you will need to assign it to one or more installed agents at this time.
•
On the Agent Configuration page, select one or more agents from the agent list and click the Assign tool bar button.
•
On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.
9
On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration.
Verify that Auditing is displayed in the Exclude Account column.
* 
NOTE: If you do not restart the agent, the client will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.
10
Use a user account that is included in the exclusion list to make changes to Active Directory, File Systems and/or Exchange.
11
Run the All Events report to ensure that the changes you made are NOT reported.
•
Open the Searches tab.
•
Expand the Shared | Built-In | All Events folder in the left pane.
•
Locate and double-click All Events in the right pane.

Change Auditor Product Specific Features

This section provides a summary of the features and functionality that is dependent upon a specific Change Auditor product license.

If a feature/functionality is not listed here, it works in Change Auditor regardless of the license applied.

* 
NOTE: The product will not prevent you from performing any of the administration tasks on the Administration Tasks tab; however, associated events will not be captured and/or associated protection will not occur unless the proper license is applied.

To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable events throughout the client), use the Action | Hide Unlicensed Components menu command.

 
Table 4. Change Auditor product specific features
Change Auditor feature/functionality
Change Auditor product license required
Facilities (Searches/Events)
Authentication Activity

Change Auditor for Logon Activity

NOTE: Change Auditor for Logon Activity User license is required for capturing authentication activity on server agents; Change Auditor for Logon Activity Workstation license is required for capturing authentication activity on workstation agents.
Azure Active Directory - Administrative Units

Change Auditor for Active Directory

Azure Active Directory - Application

Change Auditor for Active Directory

Azure Active Directory - Device

Change Auditor for Active Directory

Azure Active Directory - Directory

Change Auditor for Active Directory

Azure Active Directory - Group

Change Auditor for Active Directory

Azure Active Directory - Policy

Change Auditor for Active Directory

Azure Active Directory - Risk Event

Change Auditor for Active Directory

Azure Active Directory - Role

Change Auditor for Active Directory

Azure Active Directory -Sign-in

Change Auditor for Active Directory

Azure Active Directory - User

Change Auditor for Active Directory

Connection Object

Change Auditor for Active Directory

Custom AD Object Monitoring

Change Auditor for Active Directory

Custom Computer Monitoring

Change Auditor for Active Directory

Custom File System Monitoring

Change Auditor for Windows File Servers

Custom Group Monitoring

Change Auditor for Active Directory

Custom Object Monitoring

Change Auditor for Active Directory

Custom User Monitoring

Change Auditor for Active Directory

DNS Service

Change Auditor for Active Directory

DNS Zone

Change Auditor for Active Directory

Domain Configuration

Change Auditor for Active Directory

Domain Controller Authentication

Change Auditor for Logon Activity

NOTE: Change Auditor for Logon Activity User license is required for capturing domain controller authentication activity on server agents.
Domain Controller Configuration

Change Auditor for Active Directory

Dynamic Access Control

Change Auditor for Active Directory

EMC

Change Auditor for EMC

Exchange ActiveSync Monitoring

Change Auditor for Exchange

Exchange Administrative Group

Change Auditor for Exchange

Exchange Distribution List

Change Auditor for Exchange

Exchange Mailbox Monitoring

Change Auditor for Exchange

Exchange Organization

Change Auditor for Exchange

Exchange Permission Tracking

Change Auditor for Exchange

Exchange User

Change Auditor for Exchange

Forest Configuration

Change Auditor for Active Directory

FRS Service

Change Auditor for Active Directory

Group Policy Item

Change Auditor for Active Directory

Group Policy Object

Change Auditor for Active Directory

IP Security

Change Auditor for Active Directory

AD Query

Change Auditor for Active Directory Queries

Logon Session

Change Auditor for Logon Activity

NOTE: Change Auditor for Logon Activity User license is required for capturing logon session activity on server agents; Change Auditor for Logon Activity Workstation license is required for capturing logon session activity on workstation agents.
Skype for Business Administration

Change Auditor for Skype for Business

Skype for Business Configuration

Change Auditor for Skype for Business

NetApp

Change Auditor for NetApp

NETLOGON Service

Change Auditor for Active Directory

NTDS Service

Change Auditor for Active Directory

Organizational Unit (OU)

Change Auditor for Active Directory

Office 365 Exchange Online Administration

Change Auditor for Exchange

Office 365 Exchange Online Mailbox

Change Auditor for Exchange

Office 365 SharePoint Online

Change Auditor for SharePoint

Office 365 OneDrive for Business

Change Auditor for SharePoint

Replication Transport

Change Auditor for Active Directory

Schema Configuration

Change Auditor for Active Directory

SharePoint Document

Change Auditor for SharePoint

SharePoint Document Library

Change Auditor for SharePoint

SharePoint Farm

Change Auditor for SharePoint

SharePoint Folder

Change Auditor for SharePoint

SharePoint List

Change Auditor for SharePoint

SharePoint List Item

Change Auditor for SharePoint

SharePoint Permission

Change Auditor for SharePoint

SharePoint Security Group

Change Auditor for SharePoint

SharePoint Site

Change Auditor for SharePoint

SharePoint Site Collection

Change Auditor for SharePoint

Site Configuration

Change Auditor for Active Directory

Site Link Bridge Configuration

Change Auditor for Active Directory

Site Link Configuration

Change Auditor for Active Directory

SQL Broker Event

Change Auditor for SQL Server

SQL CLR Event

Change Auditor for SQL Server

SQL Cursors Event

Change Auditor for SQL Server

SQL Database Event

Change Auditor for SQL Server

SQL Data Level Database Changes

Change Auditor for SQL Server

SQL Deprecation Event

Change Auditor for SQL Server

SQL Errors and Warnings Event

Change Auditor for SQL Server

SQL Full Text Event

Change Auditor for SQL Server

SQL Locks Event

Change Auditor for SQL Server

SQL Object Event

Change Auditor for SQL Server

SQL OLEDB Event

Change Auditor for SQL Server

SQL Performance Event

Change Auditor for SQL Server

SQL Progress Report Event

Change Auditor for SQL Server

SQL Query Notifications Event

Change Auditor for SQL Server

SQL Scan Event

Change Auditor for SQL Server

SQL Security Audit Event

Change Auditor for SQL Server

SQL Server Event

Change Auditor for SQL Server

SQL Session Event

Change Auditor for SQL Server

SQL Stored Procedures Event

Change Auditor for SQL Server

SQL Transactions Event

Change Auditor for SQL Server

SQL TSQL Event

Change Auditor for SQL Server

SQL User-Configurable Event

Change Auditor for SQL Server

Subnets

Change Auditor for Active Directory

SYSVOL

Change Auditor for Active Directory

Search criteria (What tab)
Subsystem | Active Directory

Change Auditor for Active Directory

Subsystem | AD Query

Change Auditor for Active Directory Queries

Subsystem | ADAM (AD LDS)

Change Auditor for Active Directory

Subsystem | Exchange

Change Auditor for Exchange

Subsystem | Office 365

Change Auditor for Exchange

Change Auditor for SharePoint

Subsystem | File System

Change Auditor for Windows File Servers

Subsystem | Group Policy

Change Auditor for Active Directory

Subsystem | Logon Activity

Change Auditor for Logon Activity

Subsystem | SharePoint

Change Auditor for SharePoint

Subsystem | SQL

Change Auditor for SQL Server

Object Class

Change Auditor for Active Directory

Administration Task tab
Auditing task list | Forest
Active Directory

Change Auditor for Active Directory

Active Directory | Attributes

Change Auditor for Active Directory

Active Directory | Member of Group

Change Auditor for Active Directory

Active Directory | Excluded AD Query

Change Auditor for Active Directory Queries

ADAM (AD LDS)

Change Auditor for Active Directory

ADAM (AD LDS) | Attributes

Change Auditor for Active Directory

Auditing task list | Applications
Exchange Mailbox

Change Auditor for Exchange

Office 365

Change Auditor for Exchange

Change Auditor for SharePoint

SQL

Change Auditor for SQL Server

SharePoint

Change Auditor for SharePoint

Auditing task list | Server
File System

Change Auditor for Windows File Servers

Auditing task list | NAS
EMC

Change Auditor for EMC

NetApp

Change Auditor for NetApp

Protection task list | Forest
Active Directory

Change Auditor for Active Directory

ADAM (AD LDS)

Change Auditor for Active Directory

Group Policy

Change Auditor for Active Directory

Protection task list | Application
Exchange Mailbox

Change Auditor for Exchange

Protection task list | Server
File System

Change Auditor for Windows File Servers

 

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen