Change Auditor 7.2 - User Guide


	NOTE: The settings set on this page are global settings and apply to all email alert notifications and reports. For alerts, you can override the reply to, alert subject, signature and body content for individual search queries using the settings on the Alert tab (Search Properties tabs). For reports, you can override the reply to address for individual search queries using the Report tab (Search Properties tabs).


	NOTE: Change Auditor sends alerts through a single SMTP (email) relay even when multiple coordinators are configured. That is, all coordinators will use the same mail server for sending alert notifications and reports.

To enable and configure email notifications/reports:

Open the Administration Tasks page and click Configuration at the bottom of the navigation pane (left pane).

Select Coordinator in the Configuration task list to open the Coordinator Configuration page.

On the SMTP Configuration pane, select Enable SMTP for Alerts and Reporting to enable email alert notifications and reporting. Checking this option will activate the remaining fields on this page to define the mail server to be used.

Enter the following information:

•

Mail Server

•

From Address


	NOTE: Use the browse button to the right of the From Address field to launch the Select Active Directory Object dialog (Directory object picker) or Select Exchange User dialog. From the Select Active Directory Object dialog, use the Browse or Search page to locate and select a user. If the Exchange Host information is entered at the bottom of the SMTP Configuration pane, the Select Exchange Users dialog appears. On the Exchange tab, enter a name or partial name, at least three characters long, in the Find field and click Search to lookup and select an Exchange user. On the Active Directory tab, use the Browse or Search page to locate and select an Active Directory user.

•

Reply To


	NOTE: Use the button to the right of the Reply To field to launch the Select Active Directory Object dialog (Directory object picker) or Select Exchange User dialog. From the Select Active Directory Object dialog, use the Browse or Search page to locate and select a user. If the Exchange Host information is entered at the bottom of the SMTP Configuration pane, the Select Exchange Users dialog appears. On the Exchange tab, enter a string at least three characters long in the Find field and click Search to lookup and select an Exchange user. On the Active Directory tab, use the Browse or Search page to locate and select an Active Directory user.

•

Alert Subject


	NOTE: Use the button to the right of the Alert Subject field to insert a variable into the subject line or to reset it back to the default content.

Select the appropriate option to have the email notification/report sent in plain text format (default) or HTML format.

Optionally, click Configure Body to define the content of the main body, the event details and the signature to be included in your alert emails. After configuring the alert body, click OK to return to the Coordinator Configuration page.


	NOTE: The Alert Body Configuration settings do not apply to email reports. To define the content (columns) to be included in a report, use the Layout tab. In addition, you can use the Report Layouts page (Administration Tasks tab) to create customized report layout template(s) defining the header and footer information to be used in your reports.

If the specified mail server requires authentication, select the My Server Requires Authentication check box and enter the account credentials to be used.


	NOTE: Use the button to the right of the Account Name field to launch the Select Active Directory Object dialog (Directory object picker). From this dialog, use the Browse or Search page to locate and select a user.

(Optional) Enter the Exchange host information as described below:

•

Exchange Host: Enter the internet host name of your Exchange mail server. Use the field to the far right of the Exchange Host field to specify the Exchange version for your Exchange host.

•

Email: Enter your full email address.

•

My Host Requires Authentication: Select this check box if the Exchange host requires authentication and enter the Account Name and Password used to log into your email account.


	NOTE: Use the button to the right of the Account Name field to launch the Select Active Directory Object dialog (Directory object picker). From this dialog, use the Browse or Search page to locate and select a user.

Configuring the Exchange host allows you to lookup email recipients using the Exchange GAL or Active Directory. That is, when you select a browse button to lookup an email recipient from the top part of the SMTP Configuration pane, Alert Custom Email dialog or Report tab the Select Exchange User dialog appears which contains an Exchange tab where you can enter a partial name to lookup users from the Exchange GAL.

Click Test SMTP to test the mail server configuration.

Once the mail server configuration is verified, click Apply Changes to save the configuration.

Now that SMTP alerting/reporting is enabled and configured, you can enable email alert notifications for individual search definitions using the Alert tab (Search Properties tabs) and/or reporting for individual search definitions using the Report tab (Search Properties tabs).

Customize alert email content

In addition to the customizable fields (Reply To, Alert Subject and Signature) on the Coordinator Configuration dialog, you can use the Configure Body button to define the content to be used in the main body of your alert emails as well as the event details to be included.


	NOTE: When accessed through the Coordinator Configuration page, these settings will apply globally to all alert emails. However, if accessed through the Alert tab, these settings will apply to the selected alert only.


	NOTE: The Alert Body Configuration settings do not apply to email reports. To define the content (columns) to be included in a report, use the Layout tab. In addition, you can use the Report Layouts page (Administration Tasks tab) to create customized report layout templates defining the header and footer information to be used in your reports.

To customize alert email content:

Click Configure Body to display the Alert Body Configuration dialog.

Select the appropriate option (at the bottom of the dialog) to edit either the Plain Text (default) or the HTML representation of the alert emails.

Use the Main Body tab to enter the text to be included and define the overall layout of the alert body.

•

Select the Show Variables check box to display the variables that can be added to the main body of your email.

•

To add a variable, double-click the variable from the Variable list at the bottom of the page. You can also drag and drop a variable from the Variable list into the main body text box.


	NOTE: The event details defined in the Event Details tab are placed in the Main Body pane using the following tag: %EVENT_DETAILS%. This tag should not be removed from the Main Body tab if you want to include the event details in the alert emails.

Use the Event Details tab to specify the event details to be included. That is, you can rearrange the entries, remove entries, or modify text, etc.

•

Select the Show Variables check box to display a list of the variable that can be added to the event details of your alert email.

•

To add a variable, double-click the variable from the Variable list at the bottom of the page. You can also drag and drop a variable from the Variable list into the Event Details text box.


	NOTE: Do NOT modify the blue text surrounded by percent signs (e.g., %USERNAME%). These are tags which represent actual data retrieved from the Change Auditor event that triggered the alert. See Change Auditor Email Tags for more information on these tags and the data retrieved by each.

Use the Signature tab to define the content of the signature line to be used in alert emails.

After you have entered the body content and defined the event details and signature line to be included, select the Preview tab to view a sample email using your defined format and content.

Once defined, click OK to save your settings and close the Alert Body Configuration dialog.


	NOTE: Click Restore to Default to revert back to the default email content and format.

Shared Folder Configuration

To allow users to send reports to a shared folder, you must specify credentials to use to write reports and a default shared folder.

To configure the ability to send reports to a shared folder:

Open the Administration Tasks page and click Configuration.

Select Coordinator in the Configuration task list to open the Coordinator Configuration page.

Under Shared Folder Configuration, select Enable Shared Folder for Reporting. Checking this option will activate the remaining fields on this page to define the account credentials and folder to use.

Enter the credentials (account name and password) for the coordinator to use to write the reports to a shared folder. The credentials are used to write reports to the default shared folder as well as custom shared folders specified for individual reports.


	NOTE: If you are using a group Managed Service Account, ensure that the account ends with '$' and the password is left blank.

Select a shared folder to use as the default when users select to enable reporting for a search. Select Test access to ensure that the folder exists and the specified account has permissions to write to it.


	NOTE: If the default shared folder path is updated, it will be used for each report that uses it.

Group Membership Expansion

The middle pane of the Coordinator Configuration page contains options which allow you to define the schedule for expanding nested membership of Active Directory groups that are referenced in searches (Who search criteria) or groups that are defined in the Member of Group feature. Group membership will be recursively enumerated in order to determine nested group membership.

Use the following options to define group membership expansion behavior:

Table 2. Coordinator Configuration page: Group membership expansion options

Options

Description

Select the groups to expand

Select one of the following options to define how you want to expand groups:

•

Expand all groups - This expands all groups in the forest. Use this only if you are using SSIS and need the freedom to make requests for any group in the forest.

•

Expand groups that are referenced in existing queries - Change Auditor must expand all groups in queries in order to get their membership. With the membership, the events for the groups can be retrieved. This is always done and cannot be disabled.

•

Expand groups that are referenced in existing queries and selected groups (default) - In addition to the groups referenced in existing queries, you have the ability to select other groups. This would be useful when you have groups that need expansion for SSIS database requests, but you do not want to burden your production system with expanding all groups in the environment.

Group Membership Expansion list

The Group Membership Expansion list box is only available when the Expand groups that are referenced in existing queries and selected groups option is selected and displays a list of the groups to be expanded. Use Add to add groups to this list box and Remove to remove groups from the list box.

Add

Use to add groups to the group membership expansion list. Clicking this button will display the Select Active Directory Objects dialog allowing you to locate and select the groups to be added.

See Directory object picker for a description of the Browse, Search and Options pages. Note that the Find field on this dialog will display Group and cannot be changed.

Remove

Use to remove the selected group from the group membership expansion list.

Select the refresh frequency

Select from the following options to define how often you want to refresh the group membership expansion list.

Refresh group membership every nnn minutes

By default, group membership will be refreshed every 360 minutes. Use the arrow controls to increase or decrease this value.

Valid range: 10 - 43200

Number of groups to expand every 5-minute cycle

By default, 20 groups will be expanded every 5-minute cycle. Use the arrow controls to increase or decrease this value

Valid range: 1 - 100000

Refresh the list of expanded groups every nnn minutes

By default, the group membership expansion list is refreshed every 180 minutes. Use the arrow controls to increase or decrease this value.