Change Auditor 7.3 - PowerShell User Guide

Managing Office 365 auditing

Change Auditor for Exchange and Change Auditor for SharePoint have been extended to include the auditing of activities taking place in Exchange Online, SharePoint Online, and OneDrive for Business. The following commands are available to manage Office 365 auditing:

NOTE: When you delete a template (see Remove-CAAgentTemplate), the web application created in Azure Active Directory remains. You can delete the web application using the Azure management portal. If you do not have the portal, see https://technet.microsoft.com/en-us/library/dn832618.aspx for instructions.

NOTE: If your organization uses a proxy server to connect to the internet, you must configure the agent settings to audit Azure Active Directory and Office 365 targets. (See Set-CAConfiguration)

Use this command to create a template for auditing Office 365 Exchange Online, SharePoint Online, and OneDrive for Business.

New-CAO365Template -Connection $connection -Tenant $tenant -AgentInfo $agent -CreateWebApp -GenerateCertificate -EnableExchangeOnline $true -AuditAdministration $true –AuditOrganization $true –HistoricalEventCollectionDays 7

When you create or edit an Office 365 auditing template and you select to use an existing web application, it must be configured to support certificate authentication. See the Azure Active Directory and Office 365 User Guide for the required steps.

For more details on integrating applications with Azure Active Directory and creating a web application, consult the Microsoft documentation. When creating a web application in the Azure Classic Portal, you are required to provide the following URLs: Sign-On URL, App ID URL. Specify any URL address that is unique to your tenant (for example: http://ChangeAuditorApp) for each of them.

New-CAO365Template -Connection $connection -Tenant $tenant -AgentInfo $agent -WebAppId $webAppID -WebAppKey $webAppKey1 -CertificateFile 'C:\Users\user.domain\Desktop\CertificateFile.pfx' -CertificateFilePassword $password -EnableExchangeOnline $true -AuditAdministration $true –AuditOrganization $true –HistoricalEventCollectionDays 7

Use this command to edit the account used to access Office 365 Exchange Online, the type of service and events to audit, and select a new agent.

Set-CAO365Template -Connection $connection -Template $template
-AuditOrganization $true

Set-CAO365Template -Connection $connection -Template $template -EnableSharePoint $true -EnableOneDrive $true

Set-CAO365Template -Connection $connection -Template $template -CreateWebApp -GenerateCertificate -AgentInfo $agent

Set-CAO365Template -Connection $connection -Template $template -WebAppId $webAppId -WebAppKey $webAppKey -CertificateThumbprint $certificateThumbprint -AgentInfo $agent

NOTE: The certificate with the exportable private key is in the current client user personal certificate store and the web application is updated with the specified certificate (.cer file is uploaded to the web app - matching specified thumbprint).

Set-CAO365Template -Connection $connection -Template $template -AgentInfo $agent

Use this command to see all the Office 365 templates available within your installation.

Get-CAO365Templates -Connection $connection

Use this command to remove a template for auditing Office 365 Exchange Online, SharePoint Online, and OneDrive for Business.

Remove-CAO365Template -Connection $connection -Tenant $tenant

Use this command to find specific mailboxes that can be added to an existing Office 365 Exchange Online template.

NOTE: To run this command, you must first create an Office 365 auditing template. See New-CAO365Template.

Get-CAO365ExchangeMailboxes -Connection $connection -Tenant $tenant -SearchText "a"

Use this command to audit specific mailboxes in your organization by adding them to an existing Office 365 Exchange Online template.

Add-CAO365ExchangeTemplateMailboxes -Connection $connection -Template $template -Mailboxes $mailboxes –AuditOwnerEvents

Use this command to remove mailboxes from an existing Office 365 Exchange Online template.

Remove-CAO365ExchangeTemplateMailboxes -Connection $connection -Template $template –All

Use this command to retrieve a list of mailboxes being audited by a particular Office 365 Exchange Online template.

Get-CAO365ExchangeTemplateMailboxes -Connection $connection -Template $template

Get-CAO365ExchangeTemplateMailboxes -Connection $connection -Template $template -DisplayNameFilter "Sam S" -AuditTypeFilter NonOwnerOnly

Managing Skype for Business auditing

The following commands are available to manage Skype for Business auditing:

Use this command to see the list of event classes available for the Skype for Business subsystem.

Get-CASkypeEventClassInfo –Connection $connection

Use this command to add a Skype for Business template to Change Auditor.

NOTE: It is recommended that the Change Auditor Coordinator Service is running in the same forest as the Skype for Business Central Management Store (CMS) database server.

Once the template has been created, the agent is notified of the Skype for Business Central Management Store details and the events to audit.

New-CASkypeTemplate -AgentInfo $agentInfo -AuditItems $auditItems -Connection

$connection -DatabaseCMSCredential $dbCredential -TemplateName 'Skype for Business

Template' -UseWindowsAuthentication $True -Disabled $False

Use this command to see all the Skype for Business templates that have been created.

Get-CASkypeTemplates -Connection $connection

Use this command to update the properties of an existing Skype for Business template. Once the template has been updated, the agent is notified of the Skype for Business Central Management Store details, and the events to audit.

NOTE: If the Central Management Store database server has changed, you need to redeploy your agent to the new Central Management Store SQL Server, delete the existing template, then create a new template.

Set-CASkypeTemplate -Connection $connection -Template $templateToUpdate ‘Updated Skype for Business Template’ -AgentInfo &agentInfo -AuditItems &$auditItems -DatabaseCMSCredential $dbCredential -UseWindowsAuthentication $True -Disabled $False

Use this command to remove a Skype for Business template. Agents associated with the template would be notified and Skype for Business configuration events would not be audited anymore.

Remove-CASkypeTemplate -Connection $connection -TemplateName 'Skype For Business

Template'

Configuring a Quest On Demand Audit integration

Quest On Demand Audit is a Software as a Service (SaaS) application, available through quest-on-demand.com that provides extensive, customizable auditing of critical activities and detailed alerts about vital changes taking place in Microsoft Office 365 and Azure Active Directory.

On Demand Audit can also provide a single view of activity across hybrid Microsoft environments. By sending Change Auditor Active Directory event data, you can gain visibility to on premises changes (including events gathered up to 30 days prior to installing or upgrading Change Auditor).

To begin, you need to configure a connection between Change Auditor and your organization in On Demand Audit. Once the connection is made, On Demand Audit creates the required subscription used to send events from Change Auditor to On Demand Audit. For details on how Change Auditor uses subscriptions to send events, see the Change Auditor SIEM Integration Guide.

NOTE: Although the configuration is made through Change Auditor, the subscription is managed (edited and removed) through On Demand Audit. See the On Demand Audit User Guide for details.

Use this command to create the connection required to send Change Auditor event data to On Demand Audit. When you run this command, you are presented with a dialog where you need to enter the information required to configure the connection. Enter your Quest account credentials to sign in to On Demand Audit and if prompted select the organization. By default, the current installation is used for the configuration name. If required, you can enter a different name for the configuration. This is the configuration name used in On Demand Audit; it does not change the Chane Auditor installation name.

Table 2. Available parameters

Example: Create a subscription to send Active Directory event data to On Demand Audit

New-CAODAConfiguration -Connection $connection

Use this command to see the details of the current On Demand Audit configuration.

Get-CAODAConfiguration -Connection $connection

Command output

The command returns the following information.

Use this command to modify an On Demand Audit configuration.

Table 2. Available parameters

Example: Set the allowed coordinators for the On Demand Audit configuration to the computers named "coordinator1" and "coordinator2"

Set-CAODAConfiguration -Connection $connection -AllowedCoordinators @("coordinator1", "coordinator2")

Working with Active Directory protection templates

Enabling Active Directory protection allows you to lock down critical objects and attributes to prevent accidental or unauthorized creations, modifications, or deletions.

IMPORTANT: The following commands are only supported for protection templates that are stored in SQL. They will not function if the protection templates are stored in Active Directory.

The following commands are available to manage Active Directory protection:

Use this command to create an Active Directory protection template.

$protectedObject = New-CAProtectedObject -ObjectDistinguishName “ObjectName” -ProtectedScope ScopeObject -Operations Create

New-CAADProtectionTemplate -Connection $connection -Name TemplateSample1 -ProtectedObjects $protectedObject

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

New-CAADProtectionTemplate -Connection $connection -Name $templateName -ProtectedObjects $protectedObject -OverrideAccounts $overrideAccountDn -AdminAccounts $adminAccountDn -Schedule $schedule -Credential $forestCredential

Use this command to create a protected object to include in a protection template.

New-CAProtectedObject -Connection $connection -ObjectDistinguishName “ObjectName” -ProtectedScope ScopeObject -Operations Create

Use this command to remove protected objects from a protection template.

NOTE: Both the -ProtectedObject and the -All parameters are optional, however, one or the other must be specified in the command.

Remove-CAProtectedObject -Connection $connection -Template $template -ProtectedObject $protectedObjectDn

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

$templates = Get-CAADProtectionTemplates -Connection $connection -Credential $forestCredential

Remove-CAProtectedObject -Connection $connection -Templates $template[2] -ProtectedObject $protectedObjectDn -Credential $forestCredential

Use this command to input credentials for foreign forests when creating Active Directory protection templates with PowerShell.

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

New-CAADProtectionTemplate -Connection $connection -Name $templateName -ProtectedObjects $protectedObject -OverrideAccounts $overrideAccountDn -AdminAccounts $adminAccountDn -Schedule $schedule -Credential $forestCredential

Use this command to schedule when to enforce the protection.

New-CAScheduledTimeRange -Day Monday -StartTime 7 -EndTime 18

Use this command to see all the Active Directory protection templates that have been created including those in a foreign forest.

Get-CAADProtectionTemplates -Connection $connection

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

Get-CAADProtectionTemplates -Connection $connection -Credential $forestCredential

Use this command to remove an Active Directory protection template.

Remove-CAADProtectionTemplate -Connection $connection -Template $template

Example: Remove an Active Directory Protection template in a foreign forest

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

Remove-CAADProtectionTemplate -Connection $connection -Template $selectedTemplate -Credential $forestCredential

Use this command to modify Active Directory protection templates.

Set-CAADProtectionTemplate -Connection $connection -Template $template[2] -ProtectedObjects $protectedObject1, $protectedObject2 -AdminAccounts $adminAccountDn -Schedule $schedule -Disabled $False

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

$templates = Get-CAADProtectionTemplates -Connection $connection -Credential $forestCredential

Set-CAADProtectionTemplate -Connection $connection -Template $templates[2] -Schedule $schedule -Credential $forestCredential