Chat now with support
Chat mit Support

Change Auditor for Active Directory 7.4 - User Guide

Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Roles Integration Quest GPOADmin Integration Active Directory Protection Event Details Pane

Introduction

Enabling Active Directory protection allows you to lock down critical objects and attributes to prevent accidental or unauthorized creations, modifications, or deletions. This allows you to protect the environment from harmful changes that could open security holes or cause resources to become unavailable. Once enabled, if an unauthorized user attempts to modify or delete a protected object, Change Auditor prevents the operation and captures an event.

Protection can be defined for any Active Directory, Group Policy, or ADAM (AD LDS) object that you consider critical such as Organizational Units, Group Policy Object, and service accounts.

 

 
* 
NOTE: Protection Notes and Recommendations:
1
Reserve protection for locking only critical objects.
2
Do not protect regular user accounts as it could prevent users from actions such as changing their passwords.
3
Certain applications and services need to make harmless changes to the Configuration and Schema NCs through the LocalSystem account. Therefore, Quest recommends that you do not protect the following applications and services:
•
Active Directory Knowledge Consistency Checker (KCC)
•
Quest Directory Analyzer
•
Microsoft Operations Manager (MOM)
•
Microsoft Licensing Computer
•
Microsoft Message Queuing Service (MSMQ)
•
Terminal Services Licensing Computer
•
HP OpenView’s Active Directory SPI
•
Microsoft Exchange
If you protect a User object and prevent it from being deleted or modified, you are protecting all the user attributes and the forward links. You are not protecting any back linked attributes as back links are maintained by the system to ensure referential integrity only.
If you modify the user’s memberOf attribute and add the user to a group, although you get an error or warning message, the user gets added to any group that is not protected.
To prevent anyone from being added to a Group, you would protect the Group object and prevent it from being modified. By locking the Group object, you are locking its member attribute. Hence its membership cannot be modified.
4
Before you can set up ADAM auditing or protection, you must enable the File and Printer Sharing feature under the Windows Firewall.
5
If you have Quest GPOADmin integrated with your Change Auditor deployment, the GPOADmin service account is exempt from protection.
6
A protected GPO can only be changed by override accounts that are excluded from protection.

Active Directory object protection

When configured, Change Auditor prevents changes from occurring to a protected object regardless of who attempts to change the object and the tool or method used. Attempts to change or delete a protected object fail and an event is generated. These ‘failed’ events are identified in the client by displaying ‘Protected’ in the Result column on the Search Results page and Result field in an event’s detail pane.

* 
NOTE: By default, Change Auditor captures events regardless of the result of the operation mentioned in the event. However, you can specify which events to capture based on an event’s result:
•
All Results (default)
•
Success Only
•
Success and Failed Only
•
Success and Protected Only

See the Change Auditor User Guide for more information about defining the events to be captured based on result.

Active Directory protection page

This page displays when you select Active Directory from the Protection task list in the navigation pane of the Administration Tasks tab. From here, you can start the Active Directory Protection wizard to define critical Active Directory objects to protect from unauthorized modifications. You can also edit existing templates, disable and enable templates, and remove templates that are no longer being used.

The Active Directory protection page contains an expandable view of all previously defined Active Directory protection templates. To add new template, use the Add button.

* 
NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

Once added, the following information is provided for each template:

Template
Displays the name assigned to the template when it was created.
Status
Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.
Override Accounts
Indicates whether the override accounts listed are excluded from protection or included in protection. This setting corresponds to the option used at the top of the last page of the Active Directory Protection wizard:
•
Excluded from Protection - indicates that you selected the Allow option to allow only the selected accounts to change the protected objects.
•
Included in Protection - indicates that you selected the Deny option to allow all accounts to change the protected objects except for those selected.
Objects
This field is used for filtering data.
Override Account Filter
This field is used for filtering data.
Attributes
This field is used for filtering data.
 
* 
NOTE: This field is only displayed when your Active Directory and Group Policy protection templates are stored in SQL, which is the default location for storing these templates.
 

Click the expansion box to the left of the template name to expand this view and display the following details for each template:

Object Canonical
Displays the canonical name of the object being protected.
Status
Indicates whether protection for the object is enabled or disabled.
Object Class
Displays the type of object being protected (for example, computer, group, user, and so on)
Operations
Displays the type of operations to be denied for the selected object:
•
Create
•
Delete
•
Modify Attribute
•
Move
Scope
Displays the scope of coverage for the protected object:
•
This object only
•
This object and child objects only
•
This object and all child objects
Override Account
If applicable, this section of the grid displays the user and group accounts that are allowed (or not allowed) to change the protected objects.
* 
NOTE: This field is not displayed when there are no override accounts specified in the Active Directory Protection wizard.
Attribute Protection
Displays the attribute setting specified in the wizard:
•
Protect All
•
Protect Only
•
Protect Except
For Protect Only and Protect Except, click the expansion box to the left of the field to display the individual attributes included in the protection template.
Administration Account
If applicable, this section displays the user or group accounts that have been selected on the last page of the wizard to manage this protection template.
* 
NOTE: This field is displayed only when there is at least one account specified on the last page of the protection wizard and your protection templates are being stored in SQL.
 
 
* 
NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see the Change Auditor User Guide.

Active Directory protection templates

The Active Directory protection templates are global settings and apply to all agents.

* 
NOTE:  
•
If you are planning to use multiple Active Directory Protection templates, see the Change Auditor Technical Insight Guide for more information about how multiple protection templates are evaluated.
•
Agents should be installed on all Domain Controllers to ensure that protection is fully covered.
For example, if a user is restricted from making changes and accesses a Domain Controller that does not have an agent installed, they are allowed to make changes.
•
To use protection templates, you must be logged in to Change Auditor with an account with Enterprise Admin privileges.
•
You can also open the protection wizard from the event details pane. Simply open the Search Results tab, select an event, and click the Protect Object button.
•
If Active Directory integrated DNS is deployed, you can access the ForestDNSZones or DomainDNSZones partitions by right-clicking on the top-level domain object in the directory object picker.
To create an Active Directory Protection template:
1
Open the Administration Tasks tab.
2
Click Protection.
3
Select Active Directory in the Protection task list.
4
Click Add to open the Active Directory Protection wizard to specify the Active Directory objects to protect.
5
Enter a name for the protection template.
6
Use the Browse or Search pages to locate and select the object to protect.
* 
NOTE: You can select a root domain object to prevent users from linking GPOs. However, if you do so, the gPLink attribute will be added by default and you will not be able to add other Active Directory objects or additional attributes to protect.
7
Click Add to add the object. Repeat this step as required to add more objects.
You can use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog.
If you have many objects to protect, you can create a .csv file containing the object and protection details, then import them into the template.
* 
NOTE: CSV File Details

The file must follow this format:

<Canonical Name>, <Protection Scope>, <Protected Operation 1><Protected Operation 2>

<Protected Operation n>, <Foreign Agent Forest FQDN>

Valid protection scope values include:

•
This object only
•
This object and child objects only
•
This object and all child objects

Valid protected operations include:

•
Create
•
Modify
•
Delete
•
Move

Foreign Agent Forest FQDN is not required for objects in the local forest of the coordinator. If left blank, the local forest is assumed.

The import supports the list separator defined for the locale of the operating system.

Example of CSV file entry for local forest object: Forest1.com/users/TestUser1, This object only, Create Delete Modify

Example of CSV file entry for foreign forest object: Forest2.com/users/TestUser2, This object only, Create Delete Modify, Forest2.com

After you have the file created, select Import, browse to the file, and click Open.
If any objects cannot be found, you can copy the results (ctrl+c) from the list into the clipboard so that you can use the information to locate any issues and make the necessary adjustments.
8
By default, the create, modify attributes, and delete operations are selected; however, you can change this by using the drop-down arrow in the Operations cell in the list box and selecting or clearing the different operations.
9
By default, the scope of coverage is for This object only; however, you can change this by using the drop-down arrow in the Scope cell in the list box and selecting one of the other two options:
•
This object and child objects only
•
This object and all child objects
10
By default, all attributes for the object will be protected. However, if you want to protect individual attributes instead, click Next and select one of the following options to activate the attributes list:
•
Only Selected
•
All EXCEPT Selected
From the attributes list box on the left, select the individual attributes to include in this protection template, click Add, and click Next.
If you have selected to protect the userAccountControl attribute, you can select to protect specific attribute flags on the (Optional) Select Attribute Flags to Protect of the wizard. By default, all flags are selected. Clear the ALL checkbox to select specific flags and click Next.
11
To specify users or groups that can change the protected object, click Next.
Use the Browse or Search pages to locate and select the user, group, or Managed Service Accounts to exclude from protection. Click Add to add the required accounts.
12
On the next page of the wizard, you can specify users or groups to manage this protection template.
* 
NOTE: Allow is selected by default indicating that the selected users or groups can change the protected objects. However, you can select the Deny option and select individual users or groups that are not allowed to change the protected objects. When using the Deny option, you are allowing all users and groups to change the protected objects except for those selected on this page.
* 
NOTE: This page only appears when your Active Directory and Group Policy protection templates are stored in SQL, which is the default location for storing these templates.
 
* 
IMPORTANT: By default members of the Change Auditor Administrators group are authorized to access the Administration Tasks tab and perform administration tasks, including defining Active Directory and Group Policy protection; however, after you enter a user or group account on this page you are relinquishing your rights to modify the selected protection template to the users or groups specified on the last page of this protection wizard.
 
* 
NOTE: If the users or groups specified are not members of the Change Auditor Administrators group, you must add them to the AD Protection Role for them to view the Administration Tasks tab to access Active Directory and Group Policy protection templates. For more information about adding members to the AD Protection role using the Application User Interface Authorization page (in the Configuration task list of the Administration Tasks tab), see the Change Auditor User Guide.
13
On the next page of the wizard, you can schedule when to enforce the protection. You can either select to always run the protection or run only during specific times. To enable the protection only during specific times, select Protection is scheduled, and define when it should be enabled (hour blocks on a weekly basis). The times selected are the local agent time where the template is applied.
* 
NOTE: If you have denied specific users or groups the ability to change the protected objects and you have enabled a protection schedule, those users or groups are denied access only during this time. Anytime outside of when the schedule is set to enabled, these denied accounts can access the protected object.

When the schedule is disabled, all options are disabled with it, including any denied access to the specified users. The scheduling options override all other protection settings.
14
On the next page of the wizard, you can control when the protection is enabled based on the location. Location refers to the computer that is attempting to access the protected resource.
•
Protect access from all locations: Protection is always enabled regardless of the location.
•
Protect access only from select locations: Protection is only enabled for the specified locations.
•
Disable protection only for select locations: Protection is disabled for the selected locations. Enabled everywhere else.
•
Protect access from all unknown locations: All Active Directory requests from locations that cannot be determined by the Change Auditor agent will be protected.
* 
NOTE: If you have denied specific users or groups access to protected objects, but you have specified locations that can access the protected object, the denied user or group will be able to access the protected objects from these locations.

The location options override all other protection settings.
15
Click Finish to save the protection template, close the wizard and return to the Active Directory Protection page.
To modify a protection template:
* 
IMPORTANT: If the current user who is creating the protection template is not in the authorized accounts list, a warning message displays prompting the user to continue or stop with the creation of the protection template.

If you are in the authorized accounts list at template creation time, you may find yourself locked out later if someone else in the authorized accounts list decides to edit the template and remove you.

1
On the Active Directory Protection page, select the required template and click Edit.
This opens the Active Directory Protection wizard where you can modify the current list of objects, and the attribute selection, the override accounts selected, and the administration accounts authorized to manage this protection template.
* 
NOTE: You can select a root domain object to prevent users from linking GPOs. However, if you do so, the gPLink attribute will be added by default and you will not be able to add other Active Directory objects or additional attributes to protect.
2
Click Finish to save your changes and return to the Active Directory Protection page.
To disable a protection template:

Disabling a template temporarily stops protection for the specified objects without having to remove the protection template.

1
On the Active Directory protection page, either:
•
Place your cursor in the Status cell for the protection template to disable, click the arrow control, and select Disabled
•
Right-click the template to disable and select Disable
The entry in the Status column for the template changes to ‘Disabled’.
2
To re-enable the protection template, select Enable in the Status cell.
To disable an object’s protection within a protection template:
1
On the Active Directory Protection page, either:
•
Place your cursor in the Status cell for the required object, click the arrow control, and select Disabled.
•
Right-click the object and click Disable.
The entry in the Status column for the object changes to ‘Disabled’.
2
To re-enable an object’s protection, select Enable in the Status cell.
* 
NOTE: If you disable all the objects in a protection template, the template itself becomes disabled. Similarly, when you re-enable an object in the protection template, the template is automatically re-enabled.
To delete a protection template:
1
On the Active Directory Protection page, select the required template and click Delete | Delete Template.
2
Click Yes to confirm.
To delete an object from a protection template:
1
On the Active Directory Protection page, select the required object and click Delete | Delete Object.
2
Click Yes to confirm.
To delete an override account from a protection template:
* 
NOTE: When you delete the last object in a protect template, the entire protection template is deleted.
1
On the Active Directory Protection page, select the required account and click Delete | Delete Override Account.
2
Click Yes to confirm.
To delete an administration account from a protection template:
1
On the Active Directory Protection page, select the required account and click Delete | Delete Administration Account.
2
Click Yes to confirm.
Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen