Chatee ahora con Soporte
Chat con el soporte

Active Administrator 8.7 - Installation Guide

Installation Considerations for Active Administrator Installing and configuring Active Administrator Appendix: Active Administrator Server Manager

Creating alerts

A wizard guides you through creating a new Active Administrator alert. Alerts provide you the opportunity to combine different conditions into one alert that is sent to specified email recipients. You also can add a filter to the alert to further isolate audit events for the recipient.

To create a new alert
1
Select Auditing & Alerting | Alerts.
2
Click New.
3
On the Welcome page, click Next.
4
Type a name and optional description for the alert.
5
Select the priority of the alert: normal, low, or high.
6
Click Next.
7
Set up the email list of the recipients of the alert notification.
To manage the email list
•
To add a new email address, click Add and type the email address.
•
To edit a selected email address, click Edit.
•
To remove a selected email address from the list, click Remove.
8
Click Next.
9
Select the Event Definitions to include in the alert.
•
To filter the list, type text in the Filter box. The list changes as you type characters. The definitions displayed contain the characters you type. For example, if you type com, the definitions displayed may contain the words Completed or Computer.
•
To clear the filter and restore the list, click X.
•
To show only selected definitions, open the Show box, and choose Selected.
•
To show only unselected definitions, open the Show box, and choose Unselected.
10
Click Next.
11
Add alert filters.
Use this feature to help limit the number of emails sent to the specified email list. Alert filters are optional and applied to the details section of the event. Only the events that match the filter will be included in the notification email. For example, if the alert filter is Contains OU=Sales, only the events where OU=Sales appears in the details section are included in the notification email.
To define an alert filter
a
Click Add to add a new alert filter.
–OR-
Click Edit to edit a selected alert filter.
b
Select if the email Contains or Does not contain the condition text.
c
Type the text to find in the details section of the alert.
d
By default the filter conditions are combined using the OR operator. If you want to connect with the AND operator, select AND all conditions.
12
Click Next.
13
Define the quiet time during which no notifications are sent. Alerts that are triggered during the quiet time are still logged to the Alert History. Setting an Alert Quiet Time is optional.
* 
NOTE: There is also a global quiet time that you can set. The quiet times set here are in addition to any global quiet times.
To define a quiet time
a
Click Add to add a new quiet time.
–OR-
Click Edit to edit a selected quiet time.
b
Select Enabled. To disable a quiet time, clear the check box.
c
Select All Days or specify a specific day.
d
Set the start and end time.
e
By default, actions associated with the alert are stopped during quiet time. To run actions during quiet time, select the check box.
14
Click Next.
15
Set the alert threshold. The alert threshold sets limits that must be met before alerts are sent out.
To add a new threshold
a
Click Add to add a new threshold.
–OR-
Click Edit to edit a selected threshold.
b
Select Enabled. To disable a threshold, clear the check box.
c
Select the event definition from the list.
d
Select the number of events and minutes to define the threshold.
19
Click Next.
19
Define the action that this alert runs when the alert condition is met.
The action is run using the Notification service account. Please make sure the Notification Service account has sufficient rights to all of the resources needed by the action.
To define the action the alert runs
a
Select Enabled. To disable an action, clear the check box.
b
Type the full path to the .EXE file for the program or script or browse to locate the .EXE file.
* 
NOTE: The script must reside in a share on the Active Administrator server. That share must be accessible to the Active Administrator Foundation Server (AFS) service and the operator of the remote Active Administrator console. The path to the script must be entered using Uniform Naming Convention (UNC).
c
For the argument, browse to open the list of Alert Action Variables.
d
Select a variable in the top box, and then click Insert.
e
Click OK.
f
Optionally, type the path to a folder that contains the .EXE file or browse to locate the folder.
16
Click Next.
17
Review the summary.
18
Click Finish.

Setting up workstation logon auditing

With workstation logon auditing, you can audit user logon and logoff events including lock and unlock. Enabling the default port adds these workstation events to the event definitions:

•
User Locked Workstation
•
User Logoff
•
User Logon (interactive)
•
User Logon (Remote Desktop)
•
User Unlocked Workstation

See also:

•
Deploying the workstation logon audit agent
•
Enabling the default port

Deploying the workstation logon audit agent

To audit user logon events, you must enable workstation logon auditing and deploy the workstation logon audit agent to workstations and member servers. Once enabled, the workstation logon auditing service will send messages to the Active Administrator server.

* 
NOTE: The workstation logon auditing service must run under context of the local system account.
To enable workstation logon auditing
1
Select Configuration | User Logon Agent Settings.
2
Enable workstation logon auditing and verify the port number. By default the port number is 15601, which is the port for Active Administrator Foundation Service (AFS).
* 
NOTE: If Windows® Firewall is enabled on the workstation where the Active Administrator Workstation Logon Auditing Agent is installed, you need to create an exception to allow communication with Active Administrator Foundation Service (AFS) through port 15601. See Enabling the default port.
3
Click Save.
To deploy the workstation logon agent from a GPO
1
Open Windows Explorer.
2
Navigate to C:\Program Files\Quest\Active Administrator\Server\WorkstationLogonAuditAgent.
•
Copy ActiveAdministrator.admx to C:\Windows\PolicyDefinitions on a domain controller.
•
Copy ActiveAdministrator.adml to C:\Windows\PolicyDefinitions\en-US on a domain controller.
•
Copy Active Administrator 8.7 Workstation Audit Agent.msi to a share where everyone has access.
3
Log on to the domain controller where you copied the .ADMX and .ADML files in step 2.
4
Open the Group Policy Management Console (GPMC) and create a new Group Policy Object (GPO), such as Active Administrator Workstation Logon Agent.
5
Edit the GPO. Navigate to Computer Configuration | Policies | Software Settings | Software installation, right click and choose New | Package.
6
Select the Active Administrator 8.7 Workstation Audit Agent.msi package that you copied in step 2.
7
Choose the Assigned deployment method, and click OK.
8
On the same GPO, navigate to Computer Configuration | Administrative Templates | Quest Software | Active Administrator, and edit the Enable Workstation Audit Agent setting.
•
Select Enabled.
•
In the Server Name box, type the fully qualified domain name (FQDN) of the Active Administrator server.
•
In the Server Port box, type 15601.
9
Enable the GPO and apply it to the computers where you want to deploy the workstation logon agent.

Enabling the default port

If Windows Firewall is enabled on the workstation where the workstation logon auditing agent is installed, you need to create an exception to allow communication with Active Administrator® Foundation Service (AFS) through port 15601.

To enable the default port
1
On the workstation where the workstation logon auditing agent is installed, start the Windows Firewall with Advanced Security snap-in, right-click on Outbound Rules, and choose New Rule.
2
Select Port.
3
Click Next.
4
Select Specific local ports, and type 15601.
5
Click Next.
6
Select Allow the connection.
7
Click Next.
8
Click Next.
9
Type a name for the rule, and (optionally) a description.
10
Click Finish.
Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación