Chat now with support
Chat mit Support

Change Auditor for Windows File Servers 7.4 - User Guide

File System Protection

•
Introduction
•
File System Protection page
•
File System Protection templates
•
File System Protection wizard

Introduction

When licensed, Change Auditor for Windows File Servers also provides an access control model that permits administrators to secure business-critical files and folders on the file server against potentially dangerous changes.

* 
NOTE: File System protection is designed to provide protection coverage for a small number of business-critical files/folders. Protecting an entire drive or a large portion of a drive is not recommended and has the potential of causing performance impacts and poor user experience.

To use file system protection, you must first define the files/folders to protect:

1
Create a File System Protection template which specifies the files/folders to be protected.
2
Add this template to an agent configuration.
3
Assign the agent configuration to Change Auditor agents.

File System Protection page

The File System Protection page displays when File System is selected from the Protection task list in the navigation pane of the Administration Tasks tab. From this page you can launch the File System Protection wizard to specify a file or folder to be protected from unauthorized access. You can also edit existing templates, disable a template, and remove templates that are no longer being used.

 
* 
NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, refer to the Change Auditor User Guide for more information on how to gain access.

The File System Protection page contains an expandable view of all the File System Protection templates that have been previously defined. To add a new template to this list, click Add. Once added, the following information is provided for each template:

Template
Displays the name assigned to the template when it was created.
Status
Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.
Override Accounts
Indicates whether the override accounts listed are excluded from protection or included in protection. This setting corresponds to the option used at the top of the last page of the File System Protection wizard:
•
Excluded from Protection - indicates you selected the Allow option to allow only the selected accounts to change the protected objects.
•
Included in Protection - indicates you selected the Deny option to allow all accounts to change the protected objects EXCEPT for those selected.
Paths
This field is used for filtering data.
Override Account Filter
This field is used for filtering data.
 

Click the expansion box to the left of the Template name to expand this view and display the following details for each template:

Path
Displays the name of the file system included in the File System Protection template.
Status
Indicates whether the protection for the file path is enabled or disabled.
Subfolders
Indicates whether subfolders under the file system path are also being protected.
Protect
Indicates whether a file system path is to be protected (Yes) or excluded from protection (No).
File Masks
Displays the file masks specified on the first page of the wizard.
Applies To
Indicates what is being protected: Files and Folders, Files, Folders, or Shares.
Protection Type
Indicates the type of operation(s) to be prevented as specified on the first page of the wizard.
Override Account
Displays any accounts that are allowed (or not allowed) to change the protected files/folders, as specified on the last page of the wizard.
* 
NOTE: This field is not displayed when there are no override accounts specified in the File System Protection wizard.

File System Protection templates

* 
NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see the Change Auditor User Guide.

To enable protection, create a File System Protection template which specifies the files/folders to lock down. You can then add this template to an agent configuration, which then needs to be assigned to the appropriate agents.

* 
NOTE: If you are planning to use multiple File System Protection templates, refer to the Change Auditor Technical Insight Guide for more information on how multiple protection templates are evaluated.
* 
NOTE: You can also open the protection wizard from the event details pane. Simply open the Search Results tab, select an event, and click the Protect Object button.
To create a protection template:
1
Open the Administration Tasks tab.
2
Click Protection.
3
Select File System under the Protection task list to open the File System Protection page.
4
Click Add to open the File System Protection wizard which steps you through the process of creating a File System Protection template.
5
In the Template Name field, enter a descriptive name for the template.
6
In the Path field, enter or click the Browse button to specify the file system path to protect. Click Add to move the specified file system path to the selection list.
* 
NOTE: This must be a local path. Auditing and/or protecting network shares is not supported. To audit or protect those files/folders, an agent must be deployed on the share's hosting server.
7
By default, protection includes the subfolders in the selected file system path. However, to exclude the subfolders, click the arrow control in the Subfolders cell and select No.
8
By default, the specified system file path will be protected. However, to exclude the selected file system path from protection, click the arrow control in the Protect cell and select No.
9
By default, protection will be applied to both files and folders in the selected file system path. To protect just files, folders or shares, click the arrow control in the Applies To cell and select one of the following options:
•
Files
•
Folders
•
Files and Folders (default)
•
Shares
10
By default, protection will prevent ‘all’ operations from occurring. However, to protect against specific operations, click the arrow control in the Protection Type cell and select one or more of the following operations:
•
[All] (default)
•
Read
•
Write
•
Create
•
Delete
•
Rename
•
Move
•
Dacl Change
•
Owner Change
•
Sacl Change
•
Attribute Change
•
CAP Change
•
Classification Change
11
Use the File Mask field to optionally specify a file mask to protect a group of files in the selected file system path. Once you have specified a file mask, click Add to add it to the list at the bottom of the page.
12
On the next page of the wizard, use the Browse or Search page to optionally select user or group accounts which will be allowed to make changes to the protected objects selected on the previous page. Click Add to add the selected user or group to the Override Account list.
* 
NOTE: The Allow option is selected by default indicating that the selected users or groups will be allowed to change the protected objects. However, you can select the Deny option at the top of this page and select individual users or groups that are NOT allowed to change the protected objects. When using the Deny option, you are allowing all users and groups to change the protected objects except for those selected on this page.
13
On the next page of the wizard, you have the option to schedule when the protection will be enforced. You can either select to have the protection always run or have it run only during specific times. To enable the protection only during specific times, select the Protection is scheduled option, and define when it should be enabled (hour blocks on a weekly basis). The times selected are the local agent time where the template is applied.
* 
NOTE: If you have denied specific users or groups the ability to change the protected objects and you have enabled a protection schedule, those users or groups will be denied access ONLY during this time. Anytime outside of when the schedule is set to enabled, these denied accounts WILL be able to access the protected object.

When the schedule is disabled, ALL options are disabled with it, including any denied access to the specified users. The scheduling options override all other protection settings.
14
On the next page of the wizard, you have the option to control when the protection is enabled based on the location. Location refers to the computer that is attempting to access the resource that is protected.
•
Protect access from all locations: Protection is always enabled regardless of the location.
•
Protect access only from select locations: Protection is only enabled for the specified locations.
•
Disable protection only for select locations: Protection is disabled for the selected locations. Enabled everywhere else.
•
Protect access from all unknown locations: All file system requests from locations that cannot be determined by the agent will be protected.
* 
NOTE: If you have denied specific users or groups access to protected objects, but you have specified locations that CAN access the protected object, the denied user or group WILL be able to access the protected objects from these locations.

The location options override all other protection settings.
15
To create the template without assigning it to an agent configuration, click Finish.
Clicking Finish creates the template, closes the wizard, and returns you to the File System Protection page where the newly created template is now listed.
16
To create the template and assign it to an agent configuration, expand Finish and select Finish and Assign to Agent Configuration.
On the Configuration Setup dialog, use one of the following methods to assign this template to an agent configuration:
•
Select the newly created template and ‘drag and drop’ it onto a configuration in the Configuration list.
•
Select a configuration from the Configuration list and ‘drag and drop’ it onto the newly created template.
•
Select a configuration, then select the newly created template, right-click and select Assign.
•
Select a configuration, then select the newly created template, click in the corresponding Assigned cell and click Yes.
17
If this configuration is not assigned to any agents, you will need to assign it to one or more installed agents to capture the specified file system events.
•
On the Agent Configuration page, select one or more agents from the agent list and click the Assign tool bar button.
•
On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.
•
On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.
 
* 
NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.
To modify a template:
1
On the File System Protection page, select the template to be modified and click Edit.
This displays the File System Protection wizard, where you can modify the files or folders to be protected.
2
Click Finish or expand Finish and select Finish and Assign to Agent Configuration.
To disable a template:

The disable feature allows you to temporarily stop protecting the specified file path without having to remove the protection template or individual file path from an active template.

1
On the File System Protection page, use one of the following methods to disable a template:
•
Place your cursor in the Status cell for the template to be disabled, click the arrow control and select Disabled.
•
Right-click the template to be disabled and select Disable.
The entry in the Status column for the template will change to ‘Disabled’.
2
To re-enable the protection template, use the Enable option in either the Status cell or right-click menu.
To disable the protection of a file path in a template:
1
On the File System Protection page, use one of the following methods to disable a file path in a protection template:
•
Place your cursor in the Status cell for the file path to be disabled, click the arrow control and select Disabled.
•
Right-click the file path to be disabled and select Disable.
The entry in the Status column for the selected file path will change to ‘Disabled’.
2
To re-enable protection of a file path, use the Enable option in either the Status cell or right-click menu.
To delete a template:
1
On the File System Protection page, select the template to delete and click Delete | Delete Template.
2
A dialog displays confirming that you want to delete the selected template. Click Yes.
To delete a file path from a template:
1
On the File System Protection page, select the file path to be deleted and click Delete | Delete File Path.
2
A dialog displays confirming that you want to delete the selected file path from the template. Click Yes.
* 
NOTE: If the file path is the last one in the template, deleting this file path will also delete the template.
Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen