Chatee ahora con Soporte
Chat con el soporte

Change Auditor 7.3 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Who tab

The Who tab allows you to view or define the users, computers and groups to include in (or exclude from) the search definition. You can also select to include or exclude administrators. When multiple ‘who’ criteria is specified, Change Auditor uses the ‘OR’ operator to evaluate change events, returning events for activity performed by any of the users, computers, or groups listed.

The Who tab contains the following information and controls:

Runtime Prompt

Select this check box to prompt for the ‘who’ criteria when this search runs. That is, when you select Run, the Select Active Directory Object dialog is displayed allowing you to locate and select the users, computers, or groups to search.d

NOTE:  

Exclude the Following Selection(s)

Select this check box to specify the users, computers, or groups to exclude from the search. That is, Change Auditor is to search all users, computers, and groups except those listed.

Include Event Source Initiator

Select this check box if you want to include Active Roles or GPOADmin events in the search. Selecting this check box instructs Change Auditor to retrieve all change events made by the specified user account, including those initiated by Active Roles and GPOADmin.

Who list

Contains the individual users, computers and groups to include in the search (or excluded from the search if the Exclude the Following Selection(s) option is checked).

By default, all users, computers, and groups are included in a new search definition and therefore, this list is empty.

1
On the Who tab, click Add to add an active user, computer, or group to the ‘who’ list.
2
Click Add to add it to your selection list.
3
After selecting one or more directory objects, click Select to save your selection and close the dialog.
NOTE: You can use Add with Events (instead of Add) to select a user, computer, or group that already has an audit event associated with it in the database. The accounts available for selection are based on the ‘when’ clause (When tab) and the search limit (Info tab) specified for the current search.

Use this to search for events that are tied to users who have been removed from Active Directory.

4
Optionally, select Add | Administrator, select Yes or No to include or exclude users with the Administrator right, and click OK.
TIP: If you are running Active Roles or GPOADmin and want to include events generated by Active Roles or GPOADmin in the search, select the Include Event Source Initiator check box. For more information, see the Active Roles Integration or GPOADmin Integration sections in the Change Auditor Installation Guide.
1
On the Who tab, expand Add and select the Add Wildcard Expression option.
For example, LIKE *admin* finds all users with the character string ‘admin’ anywhere in the name.
NOTE: When using the Group option, the Group Membership Expansion option on the Coordinator Configuration page (on the Administration Tasks tab) must be set to Expand all groups.
3
After entering the wildcard expression to use, click OK to close the dialog and add the wildcard expression to the ‘who’ list.

What tab

Use the What tab to define ‘what’ entities to inlcude (or exclude) in the search. More specifically, using this tab you can create a search for events based on:

When criteria is specified on the What tab, Change Auditor retrieves only those events that match the criteria listed on the What tab. When multiple ‘what’ criteria is specified on this tab, Change Auditor uses the ‘AND’ operator to evaluate an event and returns only those events that meet all the specified criteria. However, when multiple subsystems (for example, Active Directory, ADAM and Exchange) are specified, Change Auditor uses the ‘OR’ operator to evaluate these entities, returning events that meet any of the specified subsystem criteria. This also applies when multiple event classes are specified. That is, when multiple event classes are specified, Change Auditor uses the ‘OR’ operator and returns any of the specified events.

Once criteria is added, the criteria list box contains an expandable view displaying the following information for all the criteria defined for the search definition:

Lists the entity (subsystem, event class, object class, severity, or result) selected. Expanding the Entity entry displays the specific criteria and any options or restrictions, defined as part of the search criteria.

Click the expansion box to the left of the Entity field to expand this view to display the following details:

Object Class - Change Auditor for Active Directory User Guide
Subsystem | Active Directory - Change Auditor for Active Directory User Guide
Subsystem | AD Query - Change Auditor for Active Directory Query User Guide
Subsystem | ADAM (AD LDS) - Change Auditor for Active Directory User Guide
Subsystem | Azure Active Directory - Office 365 and Azure Active Directory Auditing User Guide
Subsystem | Exchange - Change Auditor for Exchange User Guide
Subsystem | File System - Change Auditor for Windows File Servers User Guide, Change Auditor for EMC User Guide or Change Auditor for NetApp User Guide
Subsystem | Group Policy - Change Auditor for Active Directory User Guide
Subsystem | Logon Activity - Change Auditor for Logon Activity User Guide
Subsystem | Office 365 - Office 365 and Azure Active Directory Auditing User Guide
Subsystem | SharePoint - Change Auditor for SharePoint User Guide
Subsystem | SQL - Change Auditor for SQL Server User Guide
1
On the What tab, click Add. (Or expand the Add button and select Event Class.)
NOTE: You can use the Add with Events | Event Class command (instead of Add | Event Class) to select an entity that already has an event in the database.
2
On the Add Facilities or Event Classes dialog, select a single event, click Add, and select Add This Event or Add All Events in Facility.
To do this, select the Filter by parameter check box and then select from the available parameter values that are enabled (for example, for the DNS Entry Type parameter, you can select Static and/or Automatically expiring).
If the event has not been added to the Selections list box, click Add to add the event to the selection list.
If the event was previously added to the Selections list box, click Update Restriction to update the restrictions for the event.
NOTE: You can also use the Shift and Ctrl keys to add multiple event classes to the selection list. However, the restrictions pane and the Add | Add All Events in Facility command are not available when multiple event classes are selected.
NOTE: Select the Exclude the Above Selection(s) check box if you want to search for all event classes and facilities except those listed in the ‘what’ list.
1
On the What tab, expand Add and select Subsystem | Local Account.
NOTE: You can use the Add with Events | Subsystem | Local Account command (instead of Add | Subsystem | Local Account) to select an entity that already has an event in the database.
All Objects - select this option to include all objects
This Object - select this option to include individual objects
3
If you selected This Object, the data grid, which displays a list of all the users and groups in the local SAM databases on the selected Member Server, and associated buttons are enabled.
4
To add an account, select the account in the data grid and click Add to add it to the selection list at the bottom of the dialog. Repeat to add more accounts.
6
To select a local account on a different computer, click Browse to the right of the Account field. On the Select Active Directory Object dialog, use the Browse or Search pages to locate and select another computer.
7
Click Select to save your selection and close the dialog.
NOTE: Select the Exclude the Above Selection(s) check box if you want to search for events generated by all local accounts except those listed in the ‘what’ list.
1
On the What tab, expand Add and select Subsystem | Registry.
NOTE: You can use Add with Events | Subsystem | Registry (instead of Add | Subsystem | Registry) to select an entity that already has an event in the database.
All Registry Keys include all registry keys
This Object include only the selected objects
This Object and Child Objects Only include the selected objects and its direct child objects
This Object and All Child Objects include the selected objects and all subordinate objects (in all levels)
3
By default, All Actions is selected meaning that all the registry actions listed are included in the search definition. However, you can clear the All Actions option and select individual actions for auditing.
All Actions include all the actions. When this option is selected, all the other options are disabled. (Default)
Add Value include when a new value is added to the selected registry key.
Delete Value include when a registry key value is removed.
Modify Value include when a registry key value is modified.
Add Key include when a new registry key is added.
Delete Key include when a registry key is removed.
4
When a scope option other than All Registry Keys is selected, the registry key hierarchy is enabled allowing you to locate and select an individual registry key.
Expand the hierarchy to locate and select a registry key. Then click Add to add it to the selection list box at the bottom of the dialog. Repeat to add more registry keys.
NOTE: If you selected Add With Events, the registry key hierarchy pane is replaced with a data grid listing the registry keys that have an event associated with it in the database.
6
To select a registry key on a different computer, click Browse to the right of the Path field. On the Select a Directory Object dialog, use the Browse or Search pages to locate and select another computer.
7
Click Select to save your selection and close the dialog.
NOTE: Select the Exclude the Above Selection(s) check box if you want to search for events in all registry keys except those listed in the ‘what’ list.
1
On the What tab, expand Add and select Subsystem | Service.
NOTE: You can use Add with Events | Subsystem | Service (instead of Add | Subsystem | Service) to select an entity that already has an event in the database.
2
You can also click Add All to include all the listed services in the search definition.
3
To select services on a different computer, click Browse to the right of the You are viewing services on field. On the Select a Directory Object dialog, use the Browse or Search pages to locate and select another computer.
4
Click Select to save your selection and close the dialog.
NOTE: Select the Exclude the Above Selection(s) check box if you want to search for events to all services except those listed in the ‘what’ list.
1
On the What tab, expand Add and select Severity.
NOTE: You can use Add with Events | Severity (instead of Add | Severity) to select a severity that already has an event associated with it in the database.
2
On the Add Severities dialog, select one or more severity levels and click Add to add them to the selection list box at the bottom of the dialog.
NOTE: Select the Exclude the Above Selection(s) check box if you want to search for all events except those assigned a severity level that is listed in the ‘what’ list.
NOTE: Select the Runtime Prompt check box on this dialog to prompt for a severity every time the search is run. When this check box is checked, the data grid and buttons on this dialog are disabled.

 

1
On the What tab, expand Add and select Result.
NOTE: You can use Add with Events | Result (instead of Add | Result) to select an entity that already has an event associated with it in the database.
2
On the Add Results dialog, select one or more results (none, success, protected or failed) and use Add to add them to the selected list box at the bottom of the dialog.
NOTE: Select the Exclude The Above Selection(s) check box if you want to search for all events except those with the selected result.
NOTE: Select the Runtime Prompt check box on this dialog to prompt for a result every time the search is run. When this check box is checked, the data grid and buttons on this dialog are disabled.

 

Where tab

The Where tab allows you to specify which agents to include (or exclude) in the search definition. You can select individual agents, all agents in a specific domain, or a given site. When multiple ‘where’ criteria is added to this tab, Change Auditor uses the ‘OR’ operator to evaluate change events, returning events captured by any of the specified agents, domains, or sites.

The Where tab contains the following information and controls:

Runtime Prompt

Select this check box to prompt for the ‘where’ criteria whenever the search is run. That is, when Run is selected, the Select Active Directory Objects dialog is displayed allowing you to locate and select the agents, domains, or sites to include in the search definition.

NOTE: When this check box is checked, Add is deactivated.

Exclude the Following Selection(s)

Select this check box to specify the agents, domains, or sites to exclude from the search. That is, Change Auditor is to return events generated from all agents except those listed in the Where list.

Where list

By default, all agents are included in a new search and therefore this list box is initially empty.

Once criteria is selected, this list box contains the agents, domains, sites, and server type (if specified) to include in the search (or exclude from the search if the Exclude the Following Selection(s) option is checked).

3
Click Add to add your selection to the selection list box at the bottom of the page.
NOTE: You can use Add With Events (instead of Add) to select an agent, domain, or site which already has an event associated with it in the database.
1
On the Where tab, expand Add and select Add Wildcard Expression.
For example, LIKE *local finds all agents with a NetBIOS name that ends in ‘local’.
3
After entering the wildcard expression to use, click OK to close the dialog and add the wildcard expression to the ‘where’ list.
1
On the Where tab, expand Add and select Add Server Types.
3
Click OK to close the dialog and add the server type to the ‘Where’ list.

When tab

The When tab allows you to limit the returned results of the search by date and time. By default, a new search is set to include the change events captured this week. The When tab contains the following information and controls:

Runtime Prompt

Select this check box to prompt for the date and time interval whenever the search is run. That is, when Run is selected, the When dialog is displayed allowing you to specify the date and time range to be used in your search.

NOTE: When this check box is checked, Add is deactivated.

Date Interval

Check one of the following options to change the default setting and define a different date range to limit your search.

From/To

Select this check box and enter the date range.

From: Enter the start date for your date range; or click the arrow control to display a calendar from which to select the start date. Only events that occurred on or after this date are included in the search.
To: Enter the end date for your date range; or click the arrow control to display a calendar from which to select the end date. Only events that occurred before or on this date are included in the search.

Last

Select this check box and the appropriate relative date and value (that is, number of minutes, hours, days, weeks, months, quarters, or years).

This

Select this check box and click the arrow control to select the appropriate date and time interval:

This Day: Start parameter is TODAY at midnight local time; end parameter is the current date and time.
This Week: Start parameter is midnight local time on the day specified in the First Day of Week parameter (Regional and Location setting) on the local machine (for example, SUNDAY); end parameter is the current date and time. (Default for new searches.)
This Month: Start parameter is the first day of the current month at midnight local time; end parameter is the current date and time.

Time Interval

Use this pane to specify a time range to further limit your search.

From

Use the arrow controls to select or enter the starting time for your time range. Only events that occurred at or after this time are included in the search.

To

Use the arrow controls to select or enter the ending time for your time range. Only events that occurred before or at this time are included in the search.

Reset

Use to clear the time interval settings.

From/To - select this option and enter the date range to use.
Last - select this option and the appropriate relative date and value (that is, number of minutes, hours, days, weeks, months, quarters, or years).
This - select this option and click the arrow control to select the appropriate time interval (that is, Day, Week, or Month).
Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación