-
Título
How do I determine what objects and attributes are being audited by default? -
Descripción
Is there a list of Event Classes and Active Directory Attributes that are monitored by default? -
Resolución
By default, most attributes that are editable in Active Directory Users and Computers (dsa.msc) for user, groups and computer objects, are monitored by CA.
Please note: Only the attributes which are updated by entering data into the fields or selecting options in each of the tabs in ADUC (excluding the Attribute Editor tab) are monitored by default. The Attribute Editor tab includes all of the attributes of an object (in the same manner if you viewed the object properties using ADSIEdit.msc). For example, updating the Office or Telephone Number fields under the General tab updates the attributes physicalDeliveryOfficeName and telephoneNumber and CA captures these changes. However updating the attributes employeeNumber or extensionAttribute1 will not be captured by CA as these attributes have to be updated using the Attribute Editor tab or ADISEdit.msc
The list of events that are captured by default for each object can be found in the Active Directory Event Event Reference guide starting on the section titled Custom Computer Monitoring and continuing through Custom User Monitoring.These event relate to the attributes which are monitored by default. To disable monitoring of an attribute you would need to disable the event from View | Administration | Auditing | Audit Events. The full list of Facilities and Events that are audited can be found here as well.This list will show all enabled Audit Events, for all CA modules regardless if they are licensed or not. The list can be sorted by License Type and then Enabled or Disabled by dragging the License Type column to the space above it and then drag the Status column to the space above it.