The following scenarios explain how to use the What tab to create custom searches.
2 |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
5 |
NOTE: You can use Add with Events | Subsystem | Active Directory (instead of Add | Subsystem | Active Directory) to search for an entity that already has an event associated with it in the database. |
• |
All Active Directory Objects - select to include all objects. (Default when the Add tool bar button is used). |
• |
This Object - select to include the selected objects only. (Default when the Add With Events tool bar button is used). |
• |
This Object and Child Objects Only - select to include the selected objects and its direct child objects. |
• |
This Object and All Child Objects - select to include the selected objects and all subordinate objects (in all levels). |
• |
Members of this group - select this option to show changes made to users in a specified group. Nested groups are not supported. |
7 |
By default, All Actions is selected meaning that all the activity associated with the object generate an audited event. However, you can clear the All Actions option and select individual options. The options available are: |
• |
All Actions - select to include when any of the following actions occur (Default) |
• |
Add Attribute - select to include when an attribute is added |
• |
Delete Attribute - select to include when an attribute is deleted |
• |
Modify Attribute - select to include when an attribute is modified |
• |
Rename Object - select to include when an object is renamed |
• |
Add Object - select to include when an object is added |
• |
Delete Object - select to include when an object is deleted |
• |
Move Object - select to include when an object is moved |
• |
Other - select to include other types of activity against the selected object |
8 |
By default, All Transports is selected indicating that all Active Directory events regardless of the transport protocol used are included in the search. However, you can clear the All Transports option and select individual options. The transport options available are: |
• |
All Transports - select to include LDAP operation or LDAP queries regardless of the transport protocol used (Default) |
• |
SSL/TLS - select to include LDAP operation or LDAP queries that are secured using SSL or TLS technology |
• |
Kerberos- select to include LDAP operation or LDAP queries that are signed using Kerberos-based encryption |
• |
Simple Bind - select to include LDAP operation or LDAP queries that are secured using simple bind authentication (neither SSL\TLS or Kerberos used) |
• |
Port - select to identify a specific port used for communication |
NOTE: When you clear the All Transports check box and select both the SSL/TLS and Kerberos check boxes, only AD queries using both of these transport protocols will be included in the search results. |
9 |
When a scope other than All Active Directory Objects is selected, the directory object picker is enabled allowing you to select the objects to include in the search definition. |
NOTE: Select the Exclude the Above Selection(s) check box to search for changes to all directory objects except those listed in the ‘what’ list. |
NOTE: Select the Runtime Prompt check box on this dialog to prompt for a directory object every time the search is run. |
10 |
Once you have added all the Active Directory objects to be included in the search, click OK to save your selection and close the dialog. |
2 |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
5 |
6 |
On the Add Active Directory Container dialog, select the This Object scope. |
7 |
By default, All Actions and All Transports are included. To change any of these settings, clear the corresponding check box and select the individual options. |
• |
• |
Use Add to add the wildcard expression to the Selected Objects list box at the bottom of the dialog. |
9 |
After entering the wildcard expression to be used, click OK to close the dialog and add the wildcard expression to the ‘what’ list. |
2 |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
5 |
NOTE: You can use Add with Events | Subsystem | Group Policy (instead of Add | Subsystem | Group Policy) to search for an entity that already has an event associated with it in the database. |
• |
All Objects - select to include all objects (Default) |
• |
This Object - select to include the selected object only |
7 |
When the This Object scope option is selected, use either the Browse or Search page to search your environment to locate and select the Group Policy objects to include in the search. Use the Options page to view or modify the search options to be used to retrieve directory objects. |
NOTE: On the Add Group Policy Container, the Search page is initially displayed which contains GroupPolicyContainer in the Find field and an * wildcard character in the Name field. Simply click the Search button on this page to locate the Group Policy containers in your environment. |
The name of the directory object to import. Name values must be specified in canonical name format. |
NOTE: Select the Exclude the Above Selection(s) check box if you want to search for changes to all Group Policy Objects except those listed in the ‘what’ list. |
NOTE: Select the Runtime Prompt check box on this dialog to prompt for a Group Policy Object every time the search is run. |
8 |
Once you have added all the Group Policy Objects to be included in the search, click OK to save your selection and close the dialog. |
2 |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
5 |
6 |
On the Add Group Policy Container dialog, select the This Object scope. |
7 |
By default, All Results will be included. To change this setting, clear the All Results check box and select the individual results to be included. |
• |
• |
Use the Add button to add the wildcard expression to the Selected Objects list box at the bottom of the dialog. |
9 |
After entering the wildcard expression to be used, click OK to close the dialog and add the wildcard expression to the ‘what’ list. |
2 |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
5 |
NOTE: You can use Add with Events | Object Class (instead of Add | Object Class) to search for an entity that already has an event associated with it in the database. |
6 |
On the Add Object Class dialog select an object class and click Add to add it to the list box located across the bottom of the dialog. Repeat this step to add additional object classes. |
NOTE: Select the Exclude the Above Selection(s) check box if you want to search for changes to all object classes except those listed in the ‘what’ list. |
NOTE: Select the Runtime Prompt check box on this dialog to prompt for an object class every time the search is run. |
7 |
Once you have made your selections, click OK to save your selection and close the dialog. |
2 |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
5 |
NOTE: You can use Add with Events | Subsystem | ADAM (AD LDS) (instead of Add | Subsystem | ADAM (AD LDS)) to search for an entity that already has an event associated with it in the database. |
NOTE: The Explorer View is displayed by default; however, this display will not include member servers. Therefore, if you have installed ADAM (AD LDS) on a workgroup server, select the Grid View option at the top of the dialog to select from a list of workgroup servers. |
• |
All ADAM (AD LDS) Objects - select to include all objects. (Default when the Add tool bar button is used.) |
• |
This Object - select to include the selected objects only. (Default when the Add With Events tool bar button is used). |
• |
This Object and Child Objects Only - select to include the selected objects and its direct child objects. |
• |
This Object and All Child Objects - select to include the selected objects and all subordinate objects (in all levels). |
• |
Members of this group - select this option to show changes made to users in a specified group. Nested groups are not supported. |
9 |
By default, All Actions is selected meaning that all of the activity associated with the object will generate an audited event. However, you can clear the All Actions option and select individual options. The options available are: |
• |
All Actions - select to include when any of the following actions occur (Default) |
• |
Add Attribute - select to include when an attribute is added |
• |
Delete Attribute - select to include when an attribute is deleted |
• |
Modify Attribute - select to include when an attribute is modified |
• |
Rename Object - select to include when an object is renamed |
• |
Add Object - select to include when an object is added |
• |
Delete Object - select to include when an object is deleted |
• |
Move Object - select to include when an object is moved |
• |
Other - select to include other types of activity against the selected object |
10 |
By default, All Transports is selected indicating that all Active Directory events regardless of the transport protocol used will be included in the search. However, you can clear the All Transports option and select individual options. The transport options available are: |
• |
All Transports - select to include LDAP operation or LDAP queries regardless of the transport protocol used (Default) |
• |
SSL/TLS - select to include LDAP operation or LDAP queries that are secured using SSL or TLS technology |
• |
Kerberos- select to include LDAP operation or LDAP queries that are signed using Kerberos-based encryption |
NOTE: When you clear the All Transports check box and select both the SSL/TLS and Kerberos check boxes, only AD queries using both of these transport protocols will be included in the search results. |
• |
Port - select to identify a specific port used for communication |
11 |
When a scope other than All ADAM (AD LDS) Objects is selected, the directory object picker is activated allowing you to select the ADAM (AD LDS) containers to be included in the search definition. |
NOTE: Select the Exclude the Above Selection(s) check box if you want to search for changes to all ADAM (AD LDS) containers except those listed in the ‘what’ list. |
NOTE: Select the Runtime Prompt check box on this dialog to prompt for an ADAM (AD LDS) container every time the search is run. |
12 |
Once you have added all the ADAM (AD LDS) containers to be included in the search, click OK to save your selection and close the dialog. |
NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, refer to the Change Auditor User Guide for more information on how to gain access. |
To add an object to this list, use the Add tool bar button (or to add multiple objects, expand the Add tool bar button and select the Select Multiple Objects option). Once added, the following information will be displayed:
• |
• |
• |
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Feedback Términos de uso Privacidad Cookie Preference Center