Change Auditor 7.1.1 - Web Client User Guide

Introduction

The Administration Tasks page allows you to perform a variety of administration tasks based on the Change Auditor licenses that are applied. Click the Administration Tasks link in the expanded left pane or click the Administration Tasks icon to display the Administration Tasks page, which consists of a navigation pane to the left and information pages to the right.


	NOTE: Authorization to use the administration tasks on the Administration Tasks page is defined using the Application User Interface page. If you are denied access to the tasks on this page, refer to Application User Interface Authorization page.

The Administration Tasks page navigation pane is divided into different task lists: Configuration, Auditing and Protection. Click a task button from the bottom of the navigation pane to display a task list. Then select a task from the displayed task list to display the appropriate information page, from which you can perform the corresponding administrative task.

Administration Task lists

The following table lists the navigation pane’s task lists and a brief description of the administrative tasks that can be performed. Many of the tasks listed require a specific Change Auditor license, which is indicated by the following codes in the last column of the table:

•

Any - does not require a specific license; available with any license

•

CAAD - Change Auditor for Active Directory

•

CAEX - Change Auditor for Exchange

•

CAFS - Change Auditor for Windows File Servers

•

CASQL - Change Auditor for SQL Server

•

CAAD-Q - Change Auditor for Active Directory Queries

•

CAEMC - Change Auditor for EMC

•

CANA - Change Auditor for NetApp

•

CAFFS- Change Auditor for Fluid File System

•

CASP - Change Auditor for SharePoint


	NOTE: You are not prevented from performing any of the administration tasks on the Administration Tasks page; however, associated events are not captured and associated protection does not occur unless the proper license is applied. To view the licenses currently applied, click the information icon in the upper right corner of the heading bar and open the Licenses tab.

Table 18. Administration Task tab: Task descriptions
Task List/Task	Description	License
Configuration The following tasks are available in the Configuration task list:
Agent	Define and assign agent configurations. See Agent Configuration page, and for additional information refer to the Quest Change Auditor User Guide.	Any
Coordinator	Enable email alert notifications/reports, configure mail server to be used for SMTP alerting/reporting, define group membership expansion, and modify agent heartbeat check interval. See Coordinator Configuration page, and for additional information refer to the Quest Change Auditor User Guide.	Any
Purge Jobs	Define and schedule purge jobs for deleting events from the production database. See Purge and archive jobs, and for additional information refer to the Quest Change Auditor User Guide.	Any
Report Layouts	Define report layout templates which contain the header/footer information to be used in reports. See Report Layouts page, and for additional information refer to the Quest Change Auditor User Guide.	Any
Application User Interface	Define who is authorized to use the various Change Auditor client features. In addition you can define who is authorized to view the Active Directory and Group Policy protection tasks in Change Auditor. See Application User Interface Authorization page, and for additional information refer to the Quest Change Auditor User Guide	Any
Auditing The Auditing task list is divided into separate lists that identify configuration tasks, forest-level tasks that are globally applied, tasks that define auditing for different applications, server-level tasks that must be assigned to an agent configuration, and tasks that define NAS device auditing.
Configuration Use the tasks under this heading to configure the events to be captured by Change Auditor and to define accounts that are to be excluded from auditing.
Audit Events	Enable/disable event auditing and modify an event’s severity level or description. See Audit Events, and for additional information refer to the Quest Change Auditor User Guide.	Any
Excluded Accounts	Create Excluded Accounts templates to define individual accounts that are to be excluded from Change Auditor auditing. See Excluded Accounts auditing, and for additional information refer to the Quest Change Auditor User Guide.	Any
Forest Use the tasks under this heading to define custom auditing definitions for your Active Directory forest.
Active Directory	Define custom Active Directory object class auditing. See Active Directory auditing, and for additional information refer to the Quest Change Auditor for Active Directory User Guide.	CAAD
Attributes	Define custom Active Directory attribute auditing. See Active Directory auditing, and for additional information refer to the Quest Change Auditor for Active Directory User Guide.	CAAD
Member of Group	Define a Member of Group auditing list to specify the users to be audited based on their group membership. See Member of Group Auditing page, and for additional information refer to the Quest Change Auditor for Active Directory User Guide.	CAAD
AD Query	Define the Active Directory containers that are to be included or excluded from AD query auditing. See AD Query Auditing page, and for additional information refer to the Quest Change Auditor for Active Directory Queries User Guide.	CAAD-Q
ADAM (AD LDS)	Define custom ADAM (AD LDS) object auditing. See ADAM (AD LDS) Auditing page, and for additional information refer to the Quest Change Auditor for Active Directory User Guide.	CAAD
Attributes	Define custom ADAM (AD LDS) attribute auditing. See ADAM (AD LDS) Attribute Auditing page, and for additional information refer to the Quest Change Auditor for Active Directory User Guide.	CAAD
Applications Use the tasks under this heading to define auditing for different types of applications within your environment.
Exchange Mailbox	Define an Exchange Mailbox auditing list to specify which directory object’s mailbox activities are to be audited by Change Auditor for Exchange. See Exchange Mailbox auditing, and for additional information refer to the Quest Change Auditor for Exchange User Guide.	CAEX
SQL	Create SQL Auditing templates to define the SQL instances and operations that are to be audited. See SQL auditing, and for additional information refer to the SQL auditing for Quest Change Auditor SQL Server User Guide.	CASQL
VMware	Create VMware Auditing templates to define the VMware hosts to be audited and the Change Auditor agent to be used to audit these hosts. See VMware auditing, and for additional information refer to the Quest Change Auditor for VMware User Guide.	Any
SharePoint	Create SharePoint Auditing templates to define the SharePoint farm to be audited and the Change Auditor agent to be used to audit this farm. See SharePoint auditing, and for additional information refer to the Quest Change Auditor for SharePoint User Guide.	CASP
Server Use the tasks under this heading to create auditing templates that can then be assigned to agent configurations to enable custom server-level auditing.
File System	Create File System Auditing templates to define the files/folders that are to be audited. See File System auditing, and for additional information refer to the Quest Change Auditor for Windows File Servers User Guide.	CAFS
Registry	Create Registry Auditing templates to define the registry keys and events that are to be audited. See Registry auditing, and for additional information refer to the Quest Change Auditor User Guide.	Any
Services	Create Service Auditing templates to specify the system services that are to be audited. See Services auditing, and for additional information refer to the Quest Change Auditor User Guide.	Any
NAS Use the tasks under this heading to create auditing templates for NAS devices.
EMC	Create a separate EMC Auditing template for each CIFS file access protocol to be audited by Change Auditor, defining the EMC file server (CIFS), auditing scope and agent(s) that are to receive the EMC events. See EMC auditing, and for additional information refer to the Quest Change Auditor for EMC User Guide.	CAEMC
NetApp	Create a separate NetApp Auditing template for each NetApp filer to be audited by Change Auditor, defining the NetApp filer, the auditing scope, and the agents that are to receive the NetApp events. See NetApp auditing, and for additional information refer to the Quest Change Auditor for NetApp User Guide.	CANA
FluidFS	Create a separate FluidFS auditing template for each FluidFS cluster to be audited by Change Auditor, defining the cluster, the auditing scope, and the agents that are to receive the events. See Fluid File System (FluidFS) auditing, and for additional information refer to the Quest Change Auditor for Fluid File System User Guide.	CAFFS
Protection The Protection task list is divided into separate task lists as well: one for forest-level tasks that are globally applied, one for tasks that define protection for applications, and another for server-level tasks that must be assigned to an agent configuration.
Forest Use the tasks under this heading to define global protection definitions for your Active Directory forest.
Active Directory	Create Active Directory Protection templates to define critical Active Directory objects that are to be protected against unauthorized modifications. See Active Directory object protection, and for additional information refer to the Quest Change Auditor for Active Directory User Guide.	CAAD
ADAM (AD LDS)	Create ADAM (AD LDS) Protection templates to define critical ADAM objects that are to be protected against unauthorized modifications. See ADAM (AD LDS) object protection, and for additional information refer to the Quest Change Auditor for Active Directory User Guide.	CAAD
Group Policy	Create Group Policy Protection templates to define critical Group Policy objects that are to be protected against unauthorized modifications. See Group Policy object protection, and for additional information refer to the Quest Change Auditor for Active Directory User Guide.	CAAD
Applications Use the task under this heading to define global protection for your Exchange Mailbox application.
Exchange Mailbox	Create Exchange Mailbox Protection templates to define critical Exchange Mailboxes that are to be protected against unauthorized modifications. See Exchange Mailbox protection, and for additional information refer to the Quest Change Auditor for Exchange User Guide.	CAEX
Server Use the task under this heading to create protection templates that can then be assigned to agent configurations to enable server-level protection.
File System	Create File System Protection templates to define critical files/folders that are to be protected against unauthorized modifications. See File System protection, and for additional information refer to the Quest Change Auditor for Windows File Servers User Guide.	CAFS

Managing templates

After a template has been created on a task page, it can be modified, copied, disabled, re-enabled and deleted. The following procedures apply to previously created templates.

•

Modify a template

•

Copy a template

•

Disable/enable a template or item in a template

•

Delete a template

IMPORTANT: To enable various custom auditing and protection features, you are required to assign templates to an agent’s configuration. The custom auditing and protection features that require custom templates to be assigned to an agent’s configuration are:

•

•

•

•

•

Excluded Accounts auditing

•

File System protection

The Agent Configuration page explains how to apply the above templates using the web client. For additional information, refer to the Quest Change Auditor User Guide.

The NetApp, EMC, FluidFS, SharePoint, and VMware auditing templates define which agents are used to capture events; however, these templates do not use the agent configurations from the Agent Configuration page. See Templates with defined agents for more information.