Change Auditor for Active Directory 7.4

The Group Policy Protection wizard opens when you click Add or Edit on the Group Policy Protection page. From here, you can define the Group Policy Objects to protect from unauthorized modifications.


	NOTE: You can also open the protection wizard from the event details pane. Simply open the Search Results tab, select an event, and click the Protect Object button.

The following table provides a description of the available fields and controls:


	NOTE: A red flashing icon indicates that you have not yet entered the required information. Hovering your cursor over this icon displays a tool tip explaining what needs to be entered.

Table 8. Group Policy Protection wizard

Create or modify a Group Policy Protection Template page: On the first page of the wizard, enter a name for the template and select the Group Policy objects to be protected.

Template Name

Enter a descriptive name for the template.

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the group policy container to be protected.

Once you have selected a container, click Add to add it to the list.

If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog.

Search page

The Search page initially contains GroupPolicyContainer in the Find field and an * wildcard character in the Name field. Click Search to locate the Group Policy containers in your environment.

You can use the controls at the top of the page to search your environment for a group policy container to protect.

•

In the Find field, either enter or use the drop-down menu to select the type of object to locate. You can enter multiple classes, separated by either a comma or semicolon. When you type in an entry, either click the Enter key or use Search to display the objects.

•

In the Name field, specify a search expression to use to locate a particular object. Usually, this field contains an asterisk (*) indicating to search for all objects of the type specified in the Find field.

•

Select the ANR check box to use Ambiguous Name Resolution (ANR) as the search algorithm, which allows you to enter limited input (partial data) to find multiple objects in your network.

When the ANR check box is checked, use one of the following methods to enter your search expression:

•

Enter a partial string to return exact matches or a list of possible matches. For example, entering ‘Admin’ will return objects that contain the names ‘Admin’, ‘Admins’, ‘Administrator’, Administrators’.

•

Enter a string preceded by the equal sign (=Admins) to return only exact matches. For example, entering ‘=Admin’ returns only those objects containing the name ‘Admin’.

By default, ANR searches the following attribute fields in Active Directory:

•

First Name (GivenName)

•

Last Name (Surname)

•

Display Name (displayName)

•

LegacyExchangeDN

•

msExchMailNickname

•

Relative Discontinued Name of the object (RDN)

•

Office (physicalDeliveryOfficeName)

•

Email address (proxyAddress)

•

Security Account Manager account (sAMAccountName)

When the ANR check box is not checked, the search expression entered will be used to search only the Display Name of directory objects to locate a particular object.

To use this search mechanism, enter a string of characters and the wildcard (*) character as described below.

•

n* returns objects that start with the letter ‘n’

•

*n returns objects that end in the letter ‘n’

•

*n* returns objects that contain the letter ‘n’ within their Display Name.

Once you have selected a container, click Add to add it to the list at the bottom of the page.

Options page

Use this page to modify the search options used to retrieve directory objects.

Policy list

The list box across the bottom of the page displays the group policy containers selected for protection. Use the buttons located above this list box to add and remove containers.

•

Add — Select a container in the Browse or Search page to add it to the Policy list.

•

Remove — Select an entry in the Policy list to remove it from the template.

Operations

By default, the create, modify attributes, and delete operations are selected. To change this use the drop-down arrow in the Operations cell and select and clear operations.

When the Link operation is selected, the GPO is protected from any attempts to link to or unlink from any Active Directory container in the forest. If Enterprise protection is selected, all GPOs in the forest are protected from linking and unlinking attempts.

Do not enforce protection for GPOADmin working copy group policies

option

When enabled, GPOADmin working copies selected for the protection template (or in the AD forest if Enterprise is selected), are ignored by the template.

Name-matching is used to identify GPOADmin temporary working copies based on a name prefix "[GPOADmin Working Copy] - ". The service account for the GPOADmin service should also be excluded from protection as an allowed account when the option to exclude GPOADmin working copies is selected.

(Optional) Select Accounts Allowed (Not Allowed) to Access Protected Objects page: By default all users and groups are prevented from changing the Group Policy containers selected for protection. However, you can use this page to specify individual users or groups that are allowed (not allowed) to change the protected objects.

NOTE: Management actions performed by excluded accounts are audited but not prevented.

Allow

Allow is selected by default indicating that the users and groups selected on this page will be the only accounts allowed to change the protected objects.

Use the Browse or Search page to select the user or group accounts.

Deny

Select the Deny option if you want to allow all users and groups to change the protected objects except for those selected on this page.

Use the Browse or Search page to select the user or group accounts.

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the users or groups that will be allowed (not allowed) to change the protected objects.

After you have selected an account, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to search your environment to locate the users or groups that will be allowed (not allowed) to change the protected objects.

After you have selected an account, click Add to add it to the list.

Options page

Use the Options page to modify the search options used to retrieve directory objects.

Override Accounts list

The list box across the bottom of the page displays the user and group accounts allowed (not allowed) to make changes to the protected objects selected on the previous page of the wizard. Use the buttons located above this list box to add and remove accounts.

•

Add - Select an account in the Browse or Search page to add it to the Override Accounts list.

•

Remove - Select an account in the Override Accounts list to remove it.

(Optional) Select Accounts Authorized to Manage This Protection Template page: By default members of the ChangeAuditor Administrators group are authorized to access the Administration Tasks tab and perform administration tasks, including defining Active Directory and Group Policy protection; however, once you enter a user or group account on this page you will be relinquishing your rights to modify the selected protection template to the users/groups specified on this page of the protection wizard.

NOTE: This page only appears when your Active Directory and Group Policy protection templates are stored in SQL, which is the default location for storing these templates.

Browse page

Displays the hierarchical view of the containers in your environment allowing you to locate and select the users or groups that will be authorized to manage this protection template.

Once you have selected an account, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to search your environment to locate the users or groups that will be authorized to manage this protection template.

Once you have selected an account, click Add to add it to the list.

Options page

Use the Options page to modify the search options used to retrieve directory objects.

Administration Accounts list

The list box across the bottom of the page displays the user and group accounts authorized to manage this protection template.

NOTE: By adding accounts to this authorized accounts list, you are relinquishing your rights to modify this protection template. Only those accounts specified on this page will have access to modify this protection template.

Use the buttons located above this list box to add and remove accounts.

•

Add - Select an account in the Browse or Search page and add it to the Administration Accounts list.

•

Remove - Select an account in the Administration Accounts list to remove it.

ADAM (AD LDS) object protection

When configured, you can prevent changes to objects in specified ADAM (AD LDS) instances.

ADAM (AD LDS) protection page

The ADAM (AD LDS) protection page displays when you select ADAM (AD LDS) from the Protection task list in the navigation pane of the Administration Tasks tab. From here, you can start the ADAM (AD LDS) Protection wizard to define critical objects to protect from unauthorized modifications. You can also edit existing templates, disable and enable templates, and remove templates that are not longer being used.

The ADAM (AD LDS) Protection page contains an expandable view of all previously defined ADAM (AD LDS) protection templates. To add new ADAM (AD LDS) protection template, use the Add button. Once added, the following information is provided for each template:


	NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.

Override Accounts

Indicates whether the override accounts listed are excluded from protection or included in protection. This setting corresponds to the option used at the top of the last page of the ADAM Protection wizard:

•

Excluded from Protection - indicates you selected the Allow option to allow only the selected accounts to change the protected objects.

•

Included in Protection - indicates you selected the Deny option to allow all accounts to change the protected objects except for those selected.

Objects

This field is used for filtering data.

Override Account Filter

This field is used for filtering data.

Attributes

This field is used for filtering data.

Click the expansion box to the left of the template to expand this view and display the following details for each template:

Object Canonical

Displays the canonical name of the object being protected.

Status

Indicates whether protection for the object is enabled or disabled.

Agents

Displays the name of the agent where the associated ADAM (AD LDS) instances reside. If there are many instances that have replicated partitions, the name of each agent hosting an instance is displayed.

Configuration Set ID

Displays the unique identifier of the configuration set shared between all ADAM (AD LDS) instances that are replicating their application partitions.

Object Class

Displays the type of object being protected (such as computer, group, or user).

Operations

Displays the type of operations to be denied for the selected object:

•

•

•

•

Displays the scope of coverage for the protected object:

•

This object only

•

This object and child objects only

•

This object and all child objects

Attribute Protection

Displays the attribute setting specified in the wizard:

•

Protect All

•

Protect Only

•

Protect Except

For Protect Only and Protect Except, click the expansion box to the left of the field to display the individual attributes included in the protection template.

Override Account

If applicable, this section displays the user and group accounts that are allowed (or not allowed) to change the protected objects.


	NOTE: This field is not displayed when there are no override accounts specified in the protection wizard.

ADAM (AD LDS) protection templates


	NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see the Change Auditor User Guide.

The ADAM (AD LDS) protection templates defined are global settings and apply to all ADAM instances associated with a Change Auditor agent.


	NOTE: If you are planning to use multiple ADAM (AD LDS) Protection templates, see the Change Auditor Technical Insight Guide for more information about how multiple protection templates are evaluated.


	NOTE: You can also open the protection wizard from the event details pane. Simply open the Search Results tab, select an event, and click the Protect Object button.

To create an ADAM Protection template:

Open the Administration Tasks tab.

Click Protection.

Select ADAM (AD LDS) in the Protection task list to open the ADAM (AD LDS) protection page.

Click Add to open the ADAM (AD LDS) Protection wizard to specify the objects to protect.

On the first page of the wizard, select the ADAM (AD LDS) instance from which to choose protected objects. The list displays the ADAM (AD LDS) instances in your environment. It only shows instances running on computers with a Change Auditor agent installed.


	NOTE: If credentials are needed to connect to the selected ADAM (AD LDS) instance, a credentials required dialog is displayed prompting you to enter the appropriate credentials.

On the next page of the wizard, enter a name for the template.

Use the Browse or Search pages to locate and select the object to protect. Click Add to add the selected object to the list. Repeat this step to add additional objects.

By default, the create, modify attributes, and delete operations are selected; however, you can change this by using the drop-down arrow in the Denied Operations cell in the list box and selecting or clearing the different operations.

By default, the scope of coverage is for This object only; however, you can change this by using the drop-down arrow in the Scope cell of the list box and selecting one of the other two options:

•

This object and child objects only

•

This object and all child objects

On the next page of the wizard, select the attributes to be protected. By default, all attributes for the object will be protected. However, if you want to protect individual attributes instead, select one of the following options to activate the attributes list:

•

Only Selected

•

All EXCEPT Selected

From the attributes list box on the left, select the individual attributes to be included in this protection template and click Add to move them to the Selected Attributes list.

If you want to specify individual users or groups that are to be allowed to make changes to the protected object, click Next to display the Select Accounts Allowed (Not Allowed) to Access Protected Objects page.

Use the Browse or Search pages to locate and select the user or group accounts to exclude from this protection template. Click Add to add the accounts.

Click Finish to save the protection template, close the wizard and return to the ADAM (AD LDS) Protection page.


	NOTE: The Allow option is selected by default indicating that the selected users or groups will be allowed to change the protected objects. However, you can select the Deny option at the top of this page and select individual users or groups that are NOT allowed to change the protected objects. When using the Deny option, you are allowing all users and groups to change the protected objects except for those selected on this page.

To modify a protection template:

On the ADAM (AD LDS) protection page, select the template and click Edit.

The ADAM (AD LDS) Protection wizard opens where you can modify the current list of objects, and the attribute selection and the override accounts selected.

Click Finish to save your changes and return to the ADAM (AD LDS) protection page.

To disable a protection template:

Disabling a template allows you to temporarily stop protection for the specified objects without having to remove the protection template.

On the ADAM (AD LDS) protection page, place your cursor in the Status cell for the protection template, click the arrow control, and select Disabled.

The entry in the Status column for the template changes to ‘Disabled’.

To re-enable the protection template, use the Enable option in the Status cell.

To disable an object’s protection within a protection template:

On the ADAM (AD LDS) protection page, place your cursor in the Status cell for the object to be disabled, click the arrow control and select Disabled

The entry in the Status column for the object changes to ‘Disabled’.

To re-enable an object’s protection, use the Enable option in the Status cell.


	NOTE: If you disable all the objects in a protection template, the template itself will become disabled. Similarly, when you re-enable an object in the protection template, the template will automatically be re-enabled.

To delete a protection template:

On the ADAM (AD LDS) protection page, select the template and click Delete | Delete Template.

•

Right-click the template and click Delete.

Click Yes to confirm.

To delete an object from a protection template:

On the ADAM (AD LDS) Protection page, select the object and click Delete | Delete Object.