Tchater maintenant avec le support
Tchattez avec un ingénieur du support

Change Auditor for Active Directory 7.1.1 - User Guide

Change Auditor for Active Directory Overview Custom Active Directory Searches and Reports Custom Active Directory Object Auditing Custom Active Directory Attribute Auditing Member of Group Auditing Active Directory Federation Services Auditing ADAM (AD LDS) Auditing Active Directory Database Auditing Active Directory Protection Event Details Pane

Active Directory Protection

•
Introduction
•
Active Directory object protection
•
Group Policy Object protection
•
ADAM (AD LDS) object protection
•
Active Directory Database protection
•
Setting extra security on protected objects

Introduction

Enabling Active Directory protection allows you to lock down critical objects and attributes to prevent accidental or unauthorized creations, modifications, or deletions. This allows you to protect the environment from harmful changes that could open security holes or cause resources to become unavailable. Once enabled, if an unauthorized user attempts to modify or delete a protected object, Change Auditor prevents the operation and captures an event.

Protection can be defined for any Active Directory, Group Policy, or ADAM (AD LDS) object that you consider critical such as Organizational Units, Group Policy Object, and service accounts.

 

 
* 
NOTE: Protection Notes and Recommendations:
1
Reserve protection for locking only critical objects.
2
Do not protect regular user accounts as it could prevent users from actions such as changing their passwords.
3
Certain applications and services need to make harmless changes to the Configuration and Schema NCs through the LocalSystem account. Therefore, Quest recommends that you do not protect the following applications and services:
•
Active Directory Knowledge Consistency Checker (KCC)
•
Quest Directory Analyzer
•
Microsoft Operations Manager (MOM)
•
Microsoft Licensing Computer
•
Microsoft Message Queuing Service (MSMQ)
•
Terminal Services Licensing Computer
•
HP OpenView’s Active Directory SPI
•
Microsoft Exchange
If you protect a User object and prevent it from being deleted or modified, you are protecting all the user attributes and the forward links. You are not protecting any back linked attributes as back links are maintained by the system to ensure referential integrity only.
If you modify the user’s memberOf attribute and add the user to a group, although you get an error or warning message, the user gets added to any group that is not protected.
To prevent anyone from being added to a Group, you would protect the Group object and prevent it from being modified. By locking the Group object, you are locking its member attribute. Hence its membership cannot be modified.
4
Before you can set up ADAM auditing or protection, you must enable the File and Printer Sharing feature under the Windows Firewall.
5
If you have Quest GPOADmin integrated with your Change Auditor deployment, the GPOADmin service account is exempt from protection.
6
A protected GPO can only be changed by override accounts that are excluded from protection.

Active Directory object protection

When configured, Change Auditor prevents changes from occurring to a protected object regardless of who attempts to change the object and the tool or method used. Attempts to change or delete a protected object fail and an event is generated. These ‘failed’ events are identified in the client by displaying ‘Protected’ in the Result column on the Search Results page and Result field in an event’s detail pane.

* 
NOTE: By default, Change Auditor captures events regardless of the result of the operation mentioned in the event. However, you can specify which events to capture based on an event’s result:
•
All Results (default)
•
Success Only
•
Success and Failed Only
•
Success and Protected Only

See the Change Auditor User Guide for more information about defining the events to be captured based on result.

Active Directory protection page

This page displays when you select Active Directory from the Protection task list in the navigation pane of the Administration Tasks tab. From here, you can start the Active Directory Protection wizard to define critical Active Directory objects to protect from unauthorized modifications. You can also edit existing templates, disable and enable templates, and remove templates that are no longer being used.

The Active Directory protection page contains an expandable view of all previously defined Active Directory protection templates. To add new template, use the Add button.

* 
NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

Once added, the following information is provided for each template:

Template
Displays the name assigned to the template when it was created.
Status
Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.
Override Accounts
Indicates whether the override accounts listed are excluded from protection or included in protection. This setting corresponds to the option used at the top of the last page of the Active Directory Protection wizard:
•
Excluded from Protection - indicates that you selected the Allow option to allow only the selected accounts to change the protected objects.
•
Included in Protection - indicates that you selected the Deny option to allow all accounts to change the protected objects except for those selected.
Objects
This field is used for filtering data.
Override Account Filter
This field is used for filtering data.
Attributes
This field is used for filtering data.
 
* 
NOTE: This field is only displayed when your Active Directory and Group Policy protection templates are stored in SQL, which is the default location for storing these templates.
 

Click the expansion box to the left of the template name to expand this view and display the following details for each template:

Object Canonical
Displays the canonical name of the object being protected.
Status
Indicates whether protection for the object is enabled or disabled.
Object Class
Displays the type of object being protected (for example, computer, group, user, and so on)
Operations
Displays the type of operations to be denied for the selected object:
•
Create
•
Delete
•
Modify Attribute
•
Move
Scope
Displays the scope of coverage for the protected object:
•
This object only
•
This object and child objects only
•
This object and all child objects
Override Account
If applicable, this section of the grid displays the user and group accounts that are allowed (or not allowed) to change the protected objects.
* 
NOTE: This field is not displayed when there are no override accounts specified in the Active Directory Protection wizard.
Attribute Protection
Displays the attribute setting specified in the wizard:
•
Protect All
•
Protect Only
•
Protect Except
For Protect Only and Protect Except, click the expansion box to the left of the field to display the individual attributes included in the protection template.
Administration Account
If applicable, this section displays the user or group accounts that have been selected on the last page of the wizard to manage this protection template.
* 
NOTE: This field is displayed only when there is at least one account specified on the last page of the protection wizard and your protection templates are being stored in SQL.
 
 
* 
NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see the Change Auditor User Guide.
Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation