Change Auditor for Active Directory 7.1.1

Table 8. Custom Computer Monitoring events
Event	Description	Severity
Computer Account Disabled	Created when the computer account is disabled.	Medium
Computer Account Enabled	Created when the computer account is enabled.	Medium
Computer Added	Created when a computer account object is added to the domain.	Medium
Computer Moved	Created when a computer account object is moved within the domain.	Medium
Computer Removed	Created when a computer account object is removed from the domain.	Medium
Computer Renamed	Created when a computer account object is renamed.	Medium
Computer Service Pack Applied	Created when a service pack is applied to the computer.	Medium
Computer Service Pack Rolled Back	Created when a service pack is uninstalled from the computer.	Medium
DACL Changed on Computer Object	Created when the DACL is changed for the computer object. NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), will not report inherited access control entry (ACE) changes. This event does NOT report inherited ACL changes.	Medium
Dynamic Computer Object Added	Created when a dynamic computer object is added to a container.	Medium
Dynamic Computer Object Changed	Created when a dynamic computer object is modified.	Medium
Dynamic Computer Object Removed	Created when a dynamic computer object is removed from a container.	Medium
Owner Changed on Computer Object	Created when the owner of a computer object is changed.	Medium

Custom Group Monitoring

Table 9. Custom Group Monitoring events
Event	Description	Severity
DACL Changed on Group Object	Created when the DACL is changed for the group object. NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), do not report inherited access control entry (ACE) changes. This event does not report inherited ACL changes.	High
Dynamic Group Object Added	Created when a dynamic group object is added to a container.	Medium
Dynamic Group Object Changed	Created when a dynamic group object is modified.	Medium
Dynamic Group Object Removed	Created when a dynamic group object is removed from a container.	Medium
Group Member-Of Added	Created when a group is added to another group.	Medium
Group Member-Of Removed	Created when a group is removed from another group.	Medium
Group Object Added	Created when a new group is added to a container.	Medium
Group Object Moved	Created when a group is moved to or from a container.	Medium
Group Object Removed	Created when a group is removed from a container.	Medium
Group Renamed	Created when a group is renamed.	Medium
Group samAccountName Changed	Created when the samAccountName attribute for a group is changed.	Medium
Group Type Changed	Created when the group type for a group is changed.	Medium
Member Added to Group	Created when a new member is added to a group.	Medium
Member Removed from Group	Created when a member is removed from a group.	Medium
Nested Member Added to Group	Created when a member is added to a nested group within a monitored group.	Medium
Nested Member Removed from Group	Created when a member is removed from a nested group within a monitored group.	Medium
Owner Changed on Group Object	Created when the owner of a group object is changed.	Medium

Custom User Monitoring

Table 10. Custom User Monitoring events

Event

Description

Severity

Active Session Limit Changed for User Object

Created when the Active session limit setting is changed in the Sessions settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Allow Reconnection Changed for User Object

Created when the Allow reconnection option is changed in the Sessions settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

City Changed on User Object

Created when the City field is changed in the Address settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Company Changed for User Object

Created when the Company field is changed in the Organization settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Connect Client Drives at Logon Changed for User Object

Created when the Connect Client Drives at Logon option is changed in the Environment settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Connect Client Printers at Logon Changed for User Object

Created when the Connect Client Printers at Logon option is changed in the Environment settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Country/Region Changed on User Object

Created when the Country/Region field is changed in the Address settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

DACL Changed on User Object

Created when the DACL is changed for a user object.

NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), do not report inherited access control entry (ACE) changes. This event does not report inherited ACL changes.

High

Default to Main Client Printer Changed for User Object

Created when the Default to Main Client Printer at Logon option is changed in the Environment settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Delegation Authentication Protocol Changed for User Object

Created when the Delegation protocol is changed in the Delegation settings for a user object in the Active Directory Users and Computers administrative tool.

NOTE: The Delegation settings tab only appears when the AD User and Computers ‘Advanced Features’ option is enabled, and only on accounts with registered SPNs in domains with Windows Server® 2003 (or higher) Functional Level.

Medium

Department Changed for User Object

Created when the Department field is changed in the Organization settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Description Changed on User Object

Created when the Description field is changed in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Direct Report Added to User Object

Created when the user is added as the ‘Manager’ in the Organization settings for another user object in the Active Directory Users and Computers administrative tool.

Medium

Direct Report Removed from User Object

Created when the user is removed as the ‘Manager’ in the Organization settings for another user object in the Active Directory Users and Computers administrative tool.

Medium

Display Name Changed on User Object

Created when the Display Name field is changed in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Domain User Renamed

Created when a user’s domain user name is changed.

Medium

Dynamic User Object Added

Created when a dynamic user object is added to a container.

Medium

Dynamic User Object Changed

Created when a dynamic user object is modified.

Medium

Dynamic User Object Removed

Created when a dynamic user object is removed from a container.

Medium

Enable Remote Control Changed for User Object

Created when the Enable remote control option is changed in the Remote Control settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

End a Disconnected Session Changed for User Object

Created when the End a disconnected session setting is changed in the Sessions settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Fax Number Changed on User Object

Created when the Fax field is changed in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

First Name Changed on User Object

Created when the First Name field is changed in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Home Folder Changed on User Object

Created when the contents of either of the Home Folder fields (local or connect) are changed in the Profile settings for user in the Active Directory Users and Computers.

Medium

Home Folder Mapped Drive Changed on User Object

Created when the Home Folder: Connect mapped drive field is changed in the Profile settings for a user in Active Directory Users and Computers.

Medium

Home Telephone Number Changed on User Object

Created when the Home field is changed in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Idle Session Limit Changed for User Object

Created when the Idle session limit setting is changed in the Sessions settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Initials Changed on User Object

Created when the Initials field is changed in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

IP Phone Number Changed on User Object

Created when the IP Phone field is changed in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Last Name Changed on User Object

Created when the Last Name field is changed in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Level of Control Changed on User Object

Created when the Level of control option is changed in the Remote Control settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Logon Script Changed on User Object

Created when the Logon Script field is changed in the Profile settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Manager Changed for User Object

Created when the Manager field is changed in the Organization settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Mobile Number Changed on User Object

Created when the Mobile field is changed in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Office Changed on User Object

Created when the Office field is changed in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Fax Number Added to User Object

Created when a number is added to the Fax: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Fax Number Removed from User Object

Created when a number is removed from the Fax: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Home Telephone Number Added to User Object

Created when a number is added to the Home: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Home Telephone Number Removed from User Object

Created when a number is removed from the Home: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other IP Phone Number Added to User Object

Created when a number is added to the IP Phone: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other IP Phone Number Removed from User Object

Created when a number is removed from the IP Phone: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Mobile Number Added to User Object

Created when a number is added to the Mobile: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Mobile Number Removed from User Object

Created when a number is removed from the Mobile: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Pager Number Added to User Object

Created when a number is added to the Pager: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Pager Number Removed from User Object

Created when a number is removed from the Pager: Other list in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Telephone Number Added to User Object

Created when a number is added to the Telephone Number: Other list in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Telephone Number Removed from User Object

Created when a number is removed from the Telephone Number: Other list in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Web Page Added to User Object

Created when a web page is added to the Web Page: Other list in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Other Web Page Removed from User Object

Created when a web page is removed from the Web Page: Other list in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Owner Changed on User Object

Created when the owner of a user object is changed.

Medium

P.O. Box Changed on User Object

Created when the P.O. Box field is changed in the Address settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Pager Number Changed on User Object

Created when the Pager field is changed in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Partition Set Changed for User Object

Created when the Partition set setting is changed in the COM+ settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Primary Group ID Changed for User Object

Created when the Primary group setting is changed in the Member Of settings for a user object in the Active Directory Users and Computers administrative tool.

NOTE: This setting is only available when a global or universal security group in the user’s domain, different than the current primary group, is selected in the Member Of list.

Medium

Profile Path Changed on User Object

Created when the Profile Path field is changed in the Profile settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Published Certificate Added to User Object

Created when a certificate is added to the List of X509 certificates published for the user account field in the Published Certificate settings for a user in Active Directory User and Computers.

Medium

Published Certificate Removed from User Object

Created when a certificate is removed from the List of X509 certificates published for the user account field in the Published Certificate settings for a user in the Active Directory User and Computers administrative tool.

Medium

Require User’s Permission Changed for User Object

Created when the Require user’s permission option is changed in the Remote Control settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Service Added to Delegation List of User Object

Created when a service is added to the Services list in the Delegation settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Service Removed from Delegation List of User Object

Created when a service is removed from the Services list in the Delegation settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Starting Directory Changed for User Object

Created when the Start In field is changed in the Environment settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Starting Program Changed for User Object

Created when the Program File Name field is changed in the Environment settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

State/Province Changed on User Object

Created when the State/Province field is changed in the Address settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Street Address Changed on User Object

Created when the Street field is changed in the Address settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Telephone Notes Changed on User Object

Created when the Notes field is changed in the Telephone settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Telephone Number Changed on User Object

Created when the Telephone number field is changed in the General settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

Terminal Services Home Folder Drive Changed

Created when the Terminal Services home folder drive is changed in the Terminal Services Profile settings for an Active Directory® user object.

Medium

Terminal Services Home Folder Path Changed

Created when the Terminal Services home folder path is changed in the Terminal Services Profile settings for an Active Directory user object.

Medium

Terminal Services Home Folder Type Changed

Created when the Terminal Services home folder type is changed in the Terminal Services Profile settings for an Active Directory user object.

Medium

Terminal Services Logon Permission Changed

Created when the Deny this user permission to log on to any Terminal Server option is changed in the Terminal Services Profile settings for an Active Directory® user object.

Medium

Terminal Services User Profile Path Changed

Created when the Terminal Services user profile path is changed in the Terminal Services Profile settings for an Active Directory user object.

Medium

Title Changed for User Object

Created when the Title field is changed in the Organization settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

User Account Disabled

Created when a user account is disabled.

Medium

User Account Enabled

Created by default when a user account is enabled, including when the account is created.

Medium

User Account is Sensitive and Cannot be Delegated Option Changed

Created when the User Account is Sensitive and Cannot be Delegated option is changed on the user object account options.

Medium

User Account is Trusted for Delegation Option Changed

Created when the User Account is Trusted for Delegation option is changed on the user object account options.

Medium

User Account Locked

Created when a user’s account is locked.

Medium

User Account Re-enabled

Created when an existing user account is enabled after having been disabled. (Disabled by default)

NOTE: This event is intended for users that prefer to turn off the ‘User Account Enabled’ event so it is not generated when a user account is created.

Medium

User Account Type Changed

Created when a user object account option is changed.

Medium

User Account Unlocked

Created when a user’s account is unlocked.

Medium

User accountExpires Changed

Created when the accountExpires attribute for a user object is changed.

Medium

User Dial-in Callback Options Changed

Created when the user Dial-In callback options user attribute has changed.

Medium

User Dial-in Remote Access Permission Changed

Created when the Dial-in Remote Access Permission attribute for the user object has changed.

Medium

User Dial-in Static IP Address Changed

Created when User Dial-in Static Address user attribute has changed.

Medium

User Dial-in Static Route Added

Created when the User Dial-in Static Route added attribute has been changed

Medium

User Dial-in Static Route Removed

Created when the User Dial-in Static Route removed attribute has been changed.

Medium

User Dial-in Verify Caller-ID Changed

Created when the user Dial-in verify caller-ID user attribute has been changed.

Medium

User Do Not Require Kerberos Preauthentication Option Changed

Created when the User Do Not Require Kerberos Preauthentication option is changed on the user object account options.

Medium

User logonHours Changed

Created when the logonHours attribute for a user object is changed.

Medium

User Member-Of Added

Created when a user is added to a group.

Medium

User Member-Of Removed

Created when a user is removed from a group.

Medium

User Must Change Password at Next Logon Option Changed

Created when the User Must Change Password at the Next Logon option is changed in the Account settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

User Object Added

Created when a user is added to a container.

Medium

User Object Moved

Created when a user is moved to or from a container.

Medium

User Object Removed

Created when a user is removed from a container.

Medium

User Password Changed

Created when a user’s password is changed.

Medium

User Password Changed by Non-owner

Created when a user’s password is changed by someone other than the account owner.

Medium

User Password Never Expires Option Changed

Created when the Password Never Expires option is changed on the user object account options.

Medium

User samAccountName Changed

Created when the User log on name (pre-Windows® 2000) field (sAMAccountname attribute) is changed in the Account settings for a user object in the Active Directory Users and Computers administrative tool.

Medium

User Smart Card is Required for Interactive Logon Option Changed

Created when the User Smart Card is Required for Interactive Logon option is changed on the user object account options.

Medium

User Store Password Using Reversible Encryption Option Changed

Created when the User Store Password Using Reversible Encryption option is changed on the user object account options.

Medium

User Use DES Encryption Types for This Account Option Changed

Created when the User Use DES Encryption Types for this Account option is changed on the user object account options.

Medium

User userPrincipalName Changed

Created when the userPrincipalName attribute for a user object is changed.