Change Auditor 7.1.1 - Web Client User Guide

Protection Tasks (Administration Tasks Page)

Introduction

Protection enables administrators to lock down critical objects and attributes to prevent accidental or unauthorized creations, modifications, deletions, and access. This allows you to protect the environment from harmful changes that could open security holes or cause resources to become unavailable.

The protection task list is divided into the following separate task lists:

NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on any of these pages, see Application User Interface Authorization page for information.

Forest

With Change Auditor for Active Directory, you can protect any Active Directory, Group Policy, or ADAM (AD LDS) objects that you consider critical. Examples of such objects may include Organizational Units, Group Policy Objects, and service accounts.

NOTE: For more information, including recommendations and full descriptions of the following protection pages, see the Quest Change Auditor for Active Directory User Guide.

See the following administration task descriptions for more information:

Active Directory object protection

When configured, Change Auditor prevents changes from occurring to a protected object regardless of who attempts to change the object and the tool or method used. Attempts to change or delete a protected object fail and an event is generated. These ‘failed’ events are identified by displaying ‘Protected’ in the Result column on the Search Results page and Result field in an event’s detail pane.

NOTE: See the Quest Change Auditor User Guide for information about defining the events to capture based on result.

The Active Directory Protection page is displayed when Active Directory is selected from the Protection task list in the navigation pane of the Administration Tasks page, and contains an expandable view of all the Active Directory Protection templates that have been previously defined. From this page, you can open the Active Directory Protection wizard to define critical Active Directory objects to protect from unauthorized modifications. You can also edit existing templates, disable and enable templates, and remove templates that are no longer required.

The Active Directory protection templates defined on the Active Directory Protection page are global settings and apply to all agents.

NOTE: If you are planning to use multiple Active Directory Protection templates, see the Quest Change Auditor Technical Insight Guide for more information about how multiple protection templates are evaluated.