Change Auditor 7.4 - Web Client User Guide

File System auditing

To capture Windows File Server events, you must first complete the following steps to define the files/folders to be audited and the events to be captured:

Create a File System Auditing template which specified the files/folders and events to be audited.

Add this template to an agent configuration. (See Define agent configurations.)

Assign the agent configuration to agents. (See Assign agent configurations to agents.)


	TIP: Quest recommends a phased approach to setting up file/folder auditing for all servers. A phased approach will allow file/folder auditing to be deployed in stages so that the coordinator performance is not degraded.

File System Auditing page

The File System Auditing page is displayed when File System is selected from the Auditing task list in the navigation pane of the Administration Tasks page. From this page you can launch the File System Auditing wizard to specify the file, folder or all drives in a system that are to be audited. You can also edit existing templates, copy templates, disable/enable templates, or remove templates that are no longer being used.


	NOTE: For more information, including a full description of the page, refer to the Quest Change Auditor for Windows File Server User Guide.

To create an auditing template for a file:

Open the Administration Tasks page.

Click Auditing.

Select File System (under the Server heading in the Auditing task list) to open the File System Auditing page.

Use Add to launch the File System Auditing wizard which steps you through the process of creating a File System Auditing template.

Table 37. File System Auditing Wizard: File auditing

Enter a name for the template.

Click Next.

File Paths

Provide the name and path of the files to be audited.

Use the Events tab to select vital file events.

This must be a local path. Auditing and/or protecting network shares is not supported. To audit or protect those files/folders, a Change Auditor agent must be deployed on the share's hosting server.

For the audit path, select File.

Enter the file name and path (i.e., Drive:\Folder\FileName.ext) to be audited.

Click Add to add it to the selection list.

On the Events tab, select individual file events to be audited, or select the File Events check box to select all listed file events.

Click Next.

Excluded Processes

(Optional) Select the processes to exclude from auditing.

Enter a process to exclude

Click Add to add it to the exclusion list.

Repeat to add additional processes.

Click Finish to save the template and close the wizard.

To create an auditing template for a folder/all drives:

Open the Administration Tasks page.

Click Auditing.

Select File System (under the Server heading in the Auditing task list) to open the File System Auditing page.

Use Add to launch the File System Auditing wizard which steps you through the process of creating a File System Auditing template.

Table 38. File System Auditing Wizard: Folder/All Drives auditing

Enter a name for the template.

Click Next.

File Paths

Provide the name and path of the folders to be audited or select to audit all drives.

Use the available tabs to select specific events and file masks to audit. You can also exclude certain subfolders and files from auditing.

NOTE: This must be a local path. Auditing and/or protecting network shares is not supported. To audit or protect those files/folders, a Change Auditor agent must be deployed on the share's hosting server.

NOTE: Do not use the Inclusion tab to add additional subfolder paths onto the monitored base path (audit path specified above). It is meant to specify an inclusion mask for ONLY objects located under the monitored base path.

IMPORTANT: If you enter the name of a subfolder or file that is outside of the audited path, it will NOT be excluded from auditing.

NOTE: For file system auditing, the slash characters (\) and double asterisks (**) are not allowed in file masks; therefore, to include a specific folder (or share), use the Audit Path field at the top of the page to specify the folder (or share) to be audited and enter an * on the Inclusions tab.

For the audit path, select Folder or All Drives.

•

If Folder is selected, enter the file name and path to be audited. You can also select a system variable using the drop-down menu.

•

If All Drives is selected, the Audit Path text box will contain an asterisk (*) which cannot be changed.

Click Add to add it to the selection list.

Click in the Scope cell to change the scope of coverage.

On the Events tab, select individual file and folder events to be audited, or select the File Events and/or Folder Events check boxes to select all listed events.

On the Inclusions tab, enter a file mask to specify what is to be included in the audit using the following:

•

Fixed characters such as letters, numbers and other characters that are allowed in file names.

•

Asterisk (*) wildcard character to substitute zero or more characters.

•

Question mark (?) wildcard character to substitute a single character.

Click Add to add it to the inclusion list.

(Optional) On the Exclusions tab, specify the names and paths of any subfolders or files to exclude. The file mask can contain any combination of the following:

•

Fixed characters such as letters, numbers and other characters that are allowed in file names.

•

Asterisk (*) wildcard character to substitute zero or more characters. Use a single asterisk (*) to specify a non-recursive match (i.e., find match in the folder only; does not match any slash characters (\)). Use a double asterisk (**) to specify a recursive match (i.e., find match in the folder and all subfolders in audit path; matches slash characters (\) and directory names in paths).

•

Question mark (?) wildcard character to substitute a single character. The ? wildcard character does not match slash (\) characters.

Use Add | Folder to exclude activity against any matching files/subfolders or Add | File to exclude activity against matching files.

Discarded events

(Optional) Multiple folder open events are generated by tooltips (folder content information that is displayed when you hover your mouse over a folder) because Windows Explorer navigates the folder tree for all the sub-folders when you hover over the parent folder to see the tooltip.

(Optional) Multiple folder open events are generated by file scans because Windows Explorer opens and reads the header of all files contained in an opened folder for information to display in the window.

To ignore the folder opened events generated by this action, select the Discard Windows Explorer tooltip events from browsing option.

To ignore the folder open events generated by this action, select the Discard file open events from folder browsing option.

Click Next.

NOTE: Clicking Finish saves the template and closes the wizard.

Excluded Processes

(Optional) Select the processes to exclude from auditing.

Enter a process to exclude and click Add to add it to the exclusion list.

Repeat to add additional processes.

Click Finish to save the template and close the wizard.

Registry auditing

To capture registry events, you must first complete the following steps to define the registry keys to be audited and the events to be captured:

Create a Registry Auditing template which specifies the registry key(s) and events to be audited.

Add this template to an agent configuration. (See Define agent configurations.)

Assign the agent configuration to agents. (See Assign agent configurations to agents.)

Registry Auditing page

The Registry Auditing page is displayed when Registry is selected from the Auditing task list in the navigation pane of the Administration Tasks page, and contains an expandable view of all the Registry Auditing templates that have been previously defined. From this page you can launch the Registry Auditing wizard to specify a registry key to be audited. You can also edit existing templates, copy templates, disable/enable templates, or remove templates that are no longer being used.


	NOTE: For more information, including a full description of the page, refer to the Change Auditor User Guide.

To create a Registry Auditing template:

Open the Administration Tasks page.

Click Auditing.

Select Registry (under the Server heading in the Auditing task list) to open the Registry Auditing page.

Click Add to open the Registry Auditing wizard which steps you through the process of creating a Registry Auditing template.

Table 39. Registry Auditing Wizard

Enter a name for the template.

Click Next.

Registry Key Selection

Select the registry keys to be audited.

Use the Event tab to select any associated events that are to be audited. Use the Exclusions tab to specify sub keys to be excluded.

Enter the registry in the HKEY_LOCAL_MACHINE hive to be audited and click Add to add it to the selection list.

To change the default scope, click the entry in the Scope cell and select a different scope.

On the Events tab, select the key and value events that are to be included in the audit. Selecting the Key Events or Value Events check box selects all of the events underneath the heading.

If you selected This object and child objects only as the scope, on the Value tab you can specify a specific value for the selected key.

(Optional) On the Exclusions tab, add the names of any sub keys to be excluded from auditing. Only the names of sub keys that belong to the selected registry key should be entered.

Or use a file mask to select a group of sub keys. A file mask can contain any combination of the following:

•

Fixed characters such as letters, numbers and other characters allowed in sub key names.

•

Asterisk (*) wildcard character to substitute zero or more characters.

•

Question mark (?) wildcard character to substitute a single character.

Click Add to add it to the Exclusion list at the bottom of the page.

Click Finish to save the template and close the wizard.

Services auditing

To capture service events, you must first complete the following steps to define the services to be audited:

Create a Service Auditing template which specifies the system server(s) to be audited or excluded from auditing.

Add this template to an agent configuration. (See Define agent configurations.)

Assign the agent configuration to Change Auditor agents. (See Assign agent configurations to agents.)

Services Auditing page

The Services Auditing page is displayed when Services is selected from the Auditing task list in the navigation pane of the Administration Tasks page, and contains an expandable view of all the Service Auditing templates that have been previously defined. From this page you can launch the Service Auditing wizard to define the system services to be included in the auditing template. You can also edit existing templates, copy templates, disable/enable templates, or remove templates that are no longer being used.


	NOTE: For more information, including a full description of the page, refer to the Change Auditor User Guide.

To create a Service Auditing template:

Open the Administration Tasks page.

Click Auditing.

Select Services (under the Server heading in the Auditing task list) to open the Services Auditing page.

Click Add to open the Service Auditing wizard which allows you to define the system services to be included in the template.

Table 40. Service Auditing Wizard

Enter a name for the template.

Click Next.

Services Selection

Select the system services to be included in or excluded from auditing.

By default, all services will be audited.

Select one of the following options to define whether this template is to include or exclude system services for auditing:

•

Audit ALL services

•

Audit ALL services except the following

•

Audit ONLY the following services

If you selected either Audit ALL services except the following or Audit ONLY the following services, enter the names of the services to be included/excluded and click Add to add them to the selection list.

Click Finish to save the template and close the wizard.