Change Auditor 7.4 - PowerShell User Guide


	NOTE: It is recommended that the Change Auditor Coordinator Service is running in the same forest as the Skype for Business Central Management Store (CMS) database server.

Once the template has been created, the agent is notified of the Skype for Business Central Management Store details and the events to audit.

Table 76. Available parameters


Parameter	Description
-AgentInfo	The Change Auditor agent to audit the Skype events. This agent must be running on the Skype for Business Central Management Store database server.
-AuditItems	Collection of events to audit.
-Connection	A connection obtained by using the Connect-CAClient command.
-CMSInstanceName (Optional)	The Microsoft Skype for Business server Central Management Store (CMS) SQL Server Instance Name. The CMS Instance name must be provided only when the Change Auditor Coordinator Service is not in the same Active Directory forest as Microsoft Skype for Business Server.
-DatabaseCMSCredential	Skype for Business Central Management Store database credentials.
-TemplateName	The name of the template.
-UseWindowsAuthentication	Specifies whether to use Windows authentication when connecting to the Central Management Store database. If Windows authentication is not used, SQL Authentication will be used.
-SkipCMSDatabaseConnectivityTest (Optional)	Specifies whether to test the Central Management Store (CMS) SQL Server Connection using the supplied CMS credentials.
-Disabled (Optional)	Specifies whether the template is disabled.

Example: Create a Skype for Business template

New-CASkypeTemplate -AgentInfo $agentInfo -AuditItems $auditItems -Connection

$connection -DatabaseCMSCredential $dbCredential -TemplateName 'Skype for Business

Template' -UseWindowsAuthentication $True -Disabled $False

Get-CASkypeTemplates

Use this command to see all the Skype for Business templates that have been created.

Table 77. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.

Example: Get a list of all Skype for Business templates

Get-CASkypeTemplates -Connection $connection

Set-CASkypeTemplate

Use this command to update the properties of an existing Skype for Business template. Once the template has been updated, the agent is notified of the Skype for Business Central Management Store details, and the events to audit.


	NOTE: If the Central Management Store database server has changed, you need to redeploy your agent to the new Central Management Store SQL Server, delete the existing template, then create a new template.

Table 78. Available parameters


Parameter	Description
-AgentInfo	The Change Auditor agent to audit the Skype events. This agent must be running on the Skype for Business Central Management Store database server.
-AuditItems	Collection of events to audit.
-Connection	A connection obtained by using the Connect-CAClient command.
-DatabaseCMSCredential	Skype for Business Central Management Store database credentials.
-Template	The name of the existing template to update.
-TemplateName	The name of the template.
-UseWindowsAuthentication	Specifies whether to use Windows authentication when connecting to the Central Management Store database. If Windows authentication is not used, SQL Authentication will be used.
-SkipCMSDatabaseConnectivityTest (Optional)	Specifies whether to test the Central Management Store (CMS) SQL Server Connection using the supplied CMS credentials.
-Disabled (Optional)	Specifies whether the template is disabled.

Example: Modify a Skype for Business template

Set-CASkypeTemplate -Connection $connection -Template $templateToUpdate ‘Updated Skype for Business Template’ -AgentInfo &agentInfo -AuditItems &$auditItems -DatabaseCMSCredential $dbCredential -UseWindowsAuthentication $True -Disabled $False

Remove-CASkypeTemplate

Use this command to remove a Skype for Business template. Agents associated with the template would be notified and Skype for Business configuration events would not be audited anymore.

Table 79. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-TemplateName	The name of the template to remove.

Example: Remove a Skype for Business template

Remove-CASkypeTemplate -Connection $connection -TemplateName 'Skype For Business

Template'

Configuring a Quest On Demand Audit integration

Quest On Demand Audit is a Software as a Service (SaaS) application, available through quest-on-demand.com that provides extensive, customizable auditing of critical activities and detailed alerts about vital changes taking place in Microsoft Office 365 and Azure Active Directory.

On Demand Audit can also provide a single view of activity across hybrid Microsoft environments. By sending Change Auditor Active Directory event data, you can gain visibility to on premises changes (including events gathered up to 30 days prior to installing or upgrading Change Auditor).

To begin, you need to configure a connection between Change Auditor and your organization in On Demand Audit. Once the connection is made, On Demand Audit creates the required subscription used to send events from Change Auditor to On Demand Audit. For details on how Change Auditor uses subscriptions to send events, see the Change Auditor SIEM Integration Guide.


	NOTE: Although the configuration is made through Change Auditor, the subscription is managed (edited and removed) through On Demand Audit. See the On Demand Audit User Guide for details.

•

New-CAODAConfiguration

•

Get-CAODAConfiguration

•

Set-CAODAConfiguration

New-CAODAConfiguration

Use this command to create the connection required to send Change Auditor event data to On Demand Audit. When you run this command, you are presented with a dialog where you need to enter the information required to configure the connection. Enter your Quest account credentials to sign in to On Demand Audit and if prompted select the organization. By default, the current installation is used for the configuration name. If required, you can enter a different name for the configuration. This is the configuration name used in On Demand Audit; it does not change the Chane Auditor installation name.

Table 2. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.

Example: Create a subscription to send Active Directory event data to On Demand Audit

New-CAODAConfiguration -Connection $connection

Get-CAODAConfiguration

Use this command to see the details of the current On Demand Audit configuration.

Table 80. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-SubscriptionId (optional)	The ID of an existing On Demand Audit subscription.

Example: Get information about the On Demand Audit configuration

Get-CAODAConfiguration -Connection $connection

Command output

The command returns the following information.

Table 81. Available information about the subscription created by the configuration
Setting	Description
ActiveBatchSize	The current batch size. (The current number of events to include in a single notification message.) The batch size is automatically adjusted based on network throughput and system performance. Its value never exceeds the specified batch size.
AllowedCoordinators	List of coordinators permitted to send events.
BatchSize	Batch size. (The maximum number of events that the active batch size can increase to.)
BatchesSent	Number of batches sent.
Enabled	Whether the subscription is enabled.
EventsSent	Number of events sent.
LastCoordinator	The coordinator that is sending events. If the subscription is disabled, this is the last coordinator that sent events.
LastEventResponse	The last event response. Provides the response in JSON format from the event receiver.
LastEventTimeUTC	When the last event was sent.
NotificationInterval	How often how often (in milliseconds) notifications are sent.
StartTimeUTC	Starting point in time for events being sent.
Subscription Id	The subscription ID.
Subsystems	Subsystems that contain the event data being sent.
Webhook Subscription Id	The webhook subscription ID.

Set-CAODAConfiguration

Use this command to modify an On Demand Audit configuration.

Table 2. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command. See the Change Auditor Command Guide for details.
-AllowedCoordinators (Optional)	Specifies the DNS or NetBIOS name of the coordinators permitted to send events. By default, any coordinator can send the events. NOTE: The list order does not determine which coordinator is selected to send events.

Example: Set the allowed coordinators for the On Demand Audit configuration to the computers named "coordinator1" and "coordinator2"

Set-CAODAConfiguration -Connection $connection -AllowedCoordinators @("coordinator1", "coordinator2")

Working with Active Directory protection templates

Enabling Active Directory protection allows you to lock down critical objects and attributes to prevent accidental or unauthorized creations, modifications, or deletions.


	IMPORTANT: The following commands are only supported for protection templates that are stored in SQL. They will not function if the protection templates are stored in Active Directory.

The following commands are available to manage Active Directory protection:

•

New-CAADProtectionTemplate

•

New-CAProtectedObject

•

Remove-CAProtectedObject

•

New-CAForestCredential

•

New-CAScheduledTimeRange

•

Get-CAADProtectionTemplates

•

Remove-CAADProtectionTemplate

•

Set-CAADProtectionTemplate

New-CAADProtectionTemplate

Use this command to create an Active Directory protection template.

Table 82. Available parameters


Parameter	Description
-Credential	Credentials used to access the foreign forest.
-Name	The template name.
-ProtectedObjects	List of ProtectedObjects. See New-CAProtectedObject for details.
-Attributes (Optional)	List of attributes to protect. When AttributeType is not set to “All” this specifies the attributes for the template. Default is none.
-AttributeType (Optional)	This is applied to the list of attributes specified in the Attributes parameter. Possible values include “All”, “Only” and “AllExcept”. Default is All.
-OverrideAccounts (Optional)	Accounts allowed or not allowed to change the protected objects.
-OverrideAccountsDenied (Optional)	Specifies if you want to deny the list of user in the OverrideAccounts access. You can specify either $true or $false. Default is false which means that the user accounts are not denied access.
-AdminAccounts (Optional)	Accounts that can manage the protection template. Default is none.
-Locations (Optional)	IP addresses to protect. Default is none.
-LocationProtectionType (Optional)	Applied to the IP addresses specified by the Locations parameter. The potential values include ProtectAllLocations, ProtectSelectLocations, AllowSelectLocations, or ProtectUnknownLocations. Default is ProtectAllLocations.
-Schedule (Optional)	It is a list of PSCAScheduledTimeRange objects, created with the New-CAScheduledTimeRange cmdlet. Default is no specified schedule, which means that protection is always enabled. See New-CAScheduledTimeRange for details.

Example: Create an Active Directory protection template

$protectedObject = New-CAProtectedObject -ObjectDistinguishName “ObjectName” -ProtectedScope ScopeObject -Operations Create

New-CAADProtectionTemplate -Connection $connection -Name TemplateSample1 -ProtectedObjects $protectedObject

Example: Creating an Active Directory Protection template to protect objects in a foreign forest

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

New-CAADProtectionTemplate -Connection $connection -Name $templateName -ProtectedObjects $protectedObject -OverrideAccounts $overrideAccountDn -AdminAccounts $adminAccountDn -Schedule $schedule -Credential $forestCredential

New-CAProtectedObject

Use this command to create a protected object to include in a protection template.

Table 83. Available parameters

Parameter

Description

-ObjectDistinguishName

Distinguish name of object to protect.

-ProtectedScope (Optional)

Scope of coverage for the protected object. Specify the scope using one of the following values:

•

ScopeObject

•

ScopeOneLevel

•

ScopeSubtree

NOTE: The -ProtectedScope parameter is required for Active Directory protection templates.

-Operations

Operations to be denied for the selected object:

•

•

•

•

•

•

NOTE: You can specify multiple operations.

Example: Create a new protected object

New-CAProtectedObject -ObjectDistinguishName “ObjectName” -ProtectedScope ScopeObject -Operations Create

Remove-CAProtectedObject

Use this command to remove protected objects from a protection template.


	NOTE: Both the -ProtectedObject and the -All parameters are optional, however, one or the other must be specified in the command.

Table 84. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The PSCAProtectionTemplate object to remove protected objects from. Obtain the template objects using the Get-CAADProtectionTemplates command and filter to select the template object to remove protected objects from.
-Credential	Credentials used to access the foreign forest. NOTE: If the Active Directory protection template contains protected objects from a foreign forest, you must specify the -Credential parameter and value when getting the template object and when removing the protected object. The -Credential parameter value is obtained by running the New-CAForestCredential cmdlet.
-ProtectedObject (Optional)	Protected object (distinguished name).
-All (Optional)	Remove all the protected objects.

Example: Remove protected object

Remove-CAProtectedObject -Connection $connection -Template $template -ProtectedObject $protectedObjectDn

Example: Remove protected object from a foreign forest

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

$templates = Get-CAADProtectionTemplates -Connection $connection -Credential $forestCredential

Remove-CAProtectedObject -Connection $connection -Templates $template[2] -ProtectedObject $protectedObjectDn -Credential $forestCredential

New-CAForestCredential

Use this command to input credentials for foreign forests when creating Active Directory protection templates with PowerShell.

Table 85. Available parameters


Parameter	Description
-ForestName	The name of the forest to access.
-Credential	Credentials used to access the foreign forest. The credential object is obtained by using the Get-Credential command.

Example: Creating an Active Directory Protection template to protect objects in a foreign forest

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

New-CAScheduledTimeRange

Use this command to schedule when to enforce the protection.

Table 86. Available parameters


Parameter	Description
-Day	Spelled out day of the week to begin the protection. For example, Monday.
-StartTime	The time to start the protection. This parameter requires an integer and validates that the input is between 0 and 24 inclusive. This implies an hour of the day to start on.
-EndTime	The time to end the protection. This parameter requires an integer and validates that the input is between 0 and 24 inclusive. This implies an hour of the day to end on.

Example: Create a scheduled time range for a protected template

New-CAScheduledTimeRange -Day Monday -StartTime 7 -EndTime 18

Get-CAADProtectionTemplates

Use this command to see all the Active Directory protection templates that have been created including those in a foreign forest.

Table 87. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Credential	Credentials used to access the foreign forest.

Example: Get a list of all Active Directory Protection templates

Get-CAADProtectionTemplates -Connection $connection

Example: Get a list of all Active Directory Protection templates in a foreign forest

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

Get-CAADProtectionTemplates -Connection $connection -Credential $forestCredential

Remove-CAADProtectionTemplate

Use this command to remove an Active Directory protection template.

Table 88. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Credential	Credentials used to access the foreign forest.
-Template	The PSCAProtectionTemplate object to remove. Obtain the template objects using the Get-CAADProtectionTemplates command and filter to select the object to remove.
-Force	Removes the template without providing confirmation.

Example: Remove an Active Directory protection template

Remove-CAADProtectionTemplate -Connection $connection -Template $template

Example: Remove an Active Directory Protection template in a foreign forest

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

Remove-CAADProtectionTemplate -Connection $connection -Template $selectedTemplate -Credential $forestCredential

Set-CAADProtectionTemplate

Use this command to modify Active Directory protection templates.

Table 89. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The PSCAProtectionTemplate object to update. Obtain the template objects using the Get-CAADProtectionTemplates command and filter to select the template object to update.
-TemplateName (Optional)	Sets the template name (string).
-Credential (Optional)	Credentials used to access the foreign forest. NOTE: If the Active Directory protection template contains protected objects and accounts from a foreign forest, you must specify the -Credential parameter and value when getting the template and when modifying the template object. The -Credential parameter value is obtained by running the New-CAForestCredential cmdlet.
-ProtectedObjects (Optional)	List of ProtectedObjects. See New-CAProtectedObject for details.
-Attributes (Optional)	List of attributes to protect. When AttributeType is not set to “All” this specifies the attributes for the template. Default is none specified.
-AttributeType (Optional)	This is applied to the list of attributes specified in the Attributes parameter. Possible values include “All”, “Only” and “AllExcept”. Default is All.
-OverrideAccounts (Optional)	Accounts allowed or not allowed to change the protected objects. String array of distinguished names.
-OverrideAccountsDenied (Optional)	Specifies if you want to deny the list of user in the OverrideAccounts access. You can specify either $true or $false. Default is false which means that the user accounts are not denied access.
-AdminAccounts (Optional)	Accounts that can manage the protection template. (If accounts are specified, then only those specified accounts can manage the template. If no accounts are specified, then all Change Auditor administrators can manage the template.) Default is none specified. This is a string array of distinguished names.
-Locations (Optional)	IP addresses to protect. Default is none specified.
-LocationProtectionType (Optional)	Applied to the IP addresses specified by the Locations parameter. The potential values include ProtectAllLocations, ProtectSelectLocations, AllowSelectLocations, or ProtectUnknownLocations. Default is ProtectAllLocations.
-Schedule (Optional)	It is a list of PSCAScheduledTimeRange objects, created with the New-CAScheduledTimeRange cmdlet. Default is no specified schedule, which means that protection is always enabled. See New-CAScheduledTimeRange for details.
-Disabled (Optional)	Specifies whether the template is enabled or disabled using the Boolean $true or $false.

Example: Modify a protection template

Set-CAADProtectionTemplate -Connection $connection -Template $template[2] -ProtectedObjects $protectedObject1, $protectedObject2 -AdminAccounts $adminAccountDn -Schedule $schedule -Disabled $False

Example: Modify a template that contains foreign forest objects

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

$templates = Get-CAADProtectionTemplates -Connection $connection -Credential $forestCredential

Set-CAADProtectionTemplate -Connection $connection -Template $templates[2] -Schedule $schedule -Credential $forestCredential

Working with GPO protection templates

Enabling GPO protection, allows you to prevent all changes to Group Policy Objects, regardless of the tool that is used to make the change. Protection includes both portions of the Group Policy data: the Group Policy Object (GPO) in Active Directory and the actual configuration data stored in the SYSVOL share on domain controllers

The following commands are available to manage GPO protection:

•

New-CAGPOProtectionTemplate

•

Get-CAGPOProtectionTemplates

•

Set-CAGPOProtectionTemplate

•

Remove-CAGPOProtectionTemplate

New-CAGPOProtectionTemplate

Use this command to create a GPO protection template.

Table 90. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Credential (Optional)	Credentials used to access the foreign forest.
-TemplateName	The template name.
-ProtectedObjects	List of ProtectedObjects. See New-CAProtectedObject for details.
-DoNotProtectWorkingCopies (Optional)	When enabled, GPOADmin working copies selected for the protection template (or in the AD forest if Enterprise is selected), are ignored by the template. The parameter accepts Boolean $true or $false. NOTE: Name-matching is used to identify GPOADmin temporary working copies based on a name prefix "[GPOADmin Working Copy] - ". The service account for the GPOADmin service should also be excluded from protection as an allowed account when the option to exclude GPOADmin working copies is selected.
-OverrideAccounts (Optional)	Accounts allowed or not allowed to change the protected objects.
-OverrideAccountsDenied (Optional)	Specifies if you want to deny the list of user in the OverrideAccounts access. You can specify either $true or $false. Default is false which means that the user accounts are not denied access.
-AdminAccounts (Optional)	Accounts that can manage the protection template. Default is none.
-Disabled (Optional)	Specifies whether the template is enabled or disabled using the Boolean $true or $false.

Example: Create a GPO Protection template

$ProtectedObjects = New-CAProtectedObject -ObjectDistinguishName “distinguishedName" -Operations Modify

New-CAGPOProtectionTemplate -Connection $connection -TemplateName TemplateSample1 -ProtectedObjects $protectedObjects

$EnterpriseProtectedObject= New-CAProtectedObject -ObjectDistinguishName "Enterprise" -Operations Modify

New-CAGPOProtectionTemplate -Connection $connection -TemplateName TemplateSample1 -ProtectedObjects $EnterpriseProtectedObject

Example: Create a GPO Protection template to protect objects in a foreign forest

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

New-CAGPOProtectionTemplate -Connection $connection -TemplateName $templateName -ProtectedObjects $protectedObjects -OverrideAccounts $overrideAccountDn -AdminAccounts $adminAccountDn -Credential $forestCredential

Get-CAGPOProtectionTemplates

Use this command to see all the GPO protection templates that have been created.

Table 91. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Credential	Credentials used to access the foreign forest.

Example: Get a list of all GPO Protection templates

Get-CAGPOProtectionTemplates -Connection $connection

Example: Get a list of all GPO Protection templates with objects in a foreign forest

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

Get-CAGPOProtectionTemplates -Connection $connection -Credential $forestCredential

Example: Get a list of operations and protected objects for GPO Protection template

Get-CAGPOProtectionTemplates -Connection $connection | Where-Object {$_.TemplateName -eq "TemplateName" } | Select-Object -ExpandProperty ProtectedObjects

Set-CAGPOProtectionTemplate

Use this command to modify a GPO protection template.

Table 92. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The template to be modified.
-ProtectedObjects	List of ProtectedObjects. See New-CAProtectedObject for details.
-Credential (Optional)	Credentials used to access the foreign forest.
-TemplateName (Optional)	The new name for the template.
-DoNotProtectWorkingCopies (Optional)	When enabled, GPOADmin working copies selected for the protection template (or in the AD forest if Enterprise is selected), are ignored by the template. The parameter accepts Boolean $true or $false. NOTE: Name-matching is used to identify GPOADmin temporary working copies based on a name prefix "[GPOADmin Working Copy] - ". The service account for the GPOADmin service should also be excluded from protection as an allowed account when the option to exclude GPOADmin working copies is selected.
-OverrideAccounts (Optional)	Accounts allowed or not allowed to change the protected objects.
-OverrideAccountsDenied (Optional)	Specifies if you want to deny the list of user in the OverrideAccounts access. You can specify either $true or $false. Default is false which means that the user accounts are not denied access.
-AdminAccounts (Optional)	Accounts that can manage the protection template. Default is none.
-Disabled (Optional)	Specifies whether the template is enabled or disabled using the Boolean $true or $false.

Example: Modify a GPO Protection template

$ProtectedObjects= New-CAProtectedObject -ObjectDistinguishName "distinguishedName" -Operations Create, Delete, Modify, Link

$EnterpriseProtectedObject= New-CAProtectedObject -ObjectDistinguishName "Enterprise" -Operations Create, Delete, Modify, Link

Set-CAADProtectionTemplate -Connection $connection -Template $template - ProtectedObjects $protectedObject1, $protectedObject2 -AdminAccounts $adminAccountDn -Schedule $schedule -Disabled $False

Example: Modify a GPO template that contains foreign forest objects

$ProtectedObjects= New-CAProtectedObject -ObjectDistinguishName "distinguishedName" -Operations Create, Delete, Modify, Link

$EnterpriseProtectedObject= New-CAProtectedObject -ObjectDistinguishName "Enterprise" -Operations Create, Delete, Modify, Link

$forestCredential = New-CAForestCredential -ForestName $forestName -Credential $creds

Set-CAGPOProtectionTemplate -Connection $connection -Template $template - ProtectedObjects ($ProtectedObjects, $EnterpriseProtectedObject) - DoNotProtectWorkingCopies $true -OverrideAccounts "distinguishedName" - OverrideAccountsDenied $true -AdminAccounts "distinguishedName" -Disabled $False - Credential $forestCredential

Remove-CAGPOProtectionTemplate

Use this command to remove a GPO protection template.

Table 93. Available parameters


Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command.
-Template	The PSCAProtectionTemplate object to remove. Obtain the template objects using the Get-CAGPOProtectionTemplates command and filter to select the object to remove.
-Force	Removes the template without providing confirmation.

Example: Remove a GPO protection template

Remove-CAGPOProtectionTemplate -Connection $connection -Template $template

Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation

Veuillez sélectionner votre produit

Afin de mieux répondre à vos besoins, précisez l'objet du tchat:

Solutions recommandées pour votre problème

Change Auditor 7.4 - PowerShell User Guide

Managing Skype for Business auditing

Configuring a Quest On Demand Audit integration

Working with Active Directory protection templates

Working with GPO protection templates