Change Auditor for Active Directory 7.4

The ADAM (AD LDS) Protection wizard displays when you click Add or Edit on the ADAM (AD LDS) protection page. From the wizard, you can define the ADAM objects and attributes to protect from unauthorized modifications.


	NOTE: You can also open the protection wizard from the event details pane. Simply open the Search Results tab, select an event, and click the Protect Object button.

The following table provides a description of the available fields and controls:

Table 9. ADAM (AD LDS) Protection wizard

Select ADAM (AD LDS) instance page: The first page of the wizard displays a list of ADAM (AD LDS) instances running a Change Auditor agent in your environment.

ADAM (AD LDS) Instances

This list includes the following information about each ADAM (AD LDS) instance listed:

•

Agent - this column displays the name of the agent where each ADAM (AD LDS) instance resides.

•

Instance Name - this column displays the name of the ADAM (AD LDS) instances displayed.

•

Instance Port - this column displays the port number assigned to each of the ADAM (AD LDS) instances displayed.

Select an instance from this list. When prompted, enter the user credentials to be used to access the selected instance.

NOTE: If you have multiple ADAM (AD LDS) instances with replicating application partitions, there is no need to configure a protection template for each instance. Change Auditor will automatically send the protection configuration to each machine that is hosting an instance. You must have an agent installed on each instance host.

Select ADAM (AD LDS) Objects to Protect page: On this page, enter a name for the template and select the objects to be protected.

Template Name

Enter a descriptive name for the protection template.

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the Active Directory object(s) to be protected.

After you have selected an object, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to search your environment to locate an Active Directory object to be protected.

After you have selected an object, click Add to add it to the list.

Options page

Use the Options page to modify the search options or ADAM instance used to retrieve directory objects.

Object list

The list box across the bottom of the page displays the objects selected for protection. Use the buttons located above this list box to add and remove objects.

•

Add - Select an object in the Browse or Search page and add it to the Object list.

•

Remove - Select an entry in the Object list and remove it from the template.

Denied Operations

By default, the create, modify attributes and delete operations are selected. To change this setting, use the drop-down arrow in the Denied Operations cell and select or clear operations.

Scope

By default, the scope of coverage is set to This object only. To change this setting, use the drop-down menu in the Scope cell to select a different scope.

•

This object only

•

This object and child objects only

•

This object and all child objects

NOTE: Child objects do not refer to nested groups when protecting a group object.

(Optional) Select Attributes to Protect page: By default all attributes for the selected objects will be protected. However, you can use this page to protect individual attributes or to exclude individual attributes from protection.

All Attributes

This option is selected by default indicating that all attributes will be protected from unauthorized access.

Only Selected

Select this option to protect individual attributes. Selecting this option will activate the list boxes on this page allowing you to select the individual attributes to be protected.

All EXCEPT Selected

Select this option to protect all attributes EXCEPT those selected. Selecting this option will activate the list boxes on this page allowing you to select the individual attributes that are not to be protected.

Attributes list

The list box to the left displays all of the available attributes which may be selected for inclusion in the protection template.

NOTE: This list box is not enabled when the All Attributes option is selected.

Add

Use to move the attributes selected in the Attributes list over to the Selected Attributes list.

Remove

Use to move the attributes selected in the Selected Attributes list back over to the Attributes list.

Selected Attributes list

The list box to the right displays the attributes to be included in the protection template.

NOTE: This list box is not enabled when All Attributes are selected.

(Optional) Select Accounts Allowed (Not Allowed) to Access Protected Objects page

By default all users and groups are prevented from changing the ADAM (AD LDS) objects selected for protection. However, you can specify individual users or groups that are allowed (not allowed) to change the protected objects.

NOTE: Management actions performed by excluded accounts are audited but not prevented.

Allow (Default)

Indicates that the users and groups selected on this page ate the only accounts allowed to change the protected objects.

Use the Browse or Search page to select the user or group accounts.

Deny

Select this if you want to allow all users and groups to change the protected objects except for those selected on this page.

Use the Browse or Search page to select the user or group accounts.

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the users or groups that will be allowed (not allowed) to change the protected objects.

After you have selected an account, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to locate the users or groups that will be allowed (not allowed) to change the protected objects.

After you have selected an account, click Add to add it to the list.

Options page

Use to modify the search options used to retrieve directory objects.

Override Accounts list

The list box across the bottom of the page displays the user and group account(s) that will be allowed (not allowed) to make changes to the protected objects selected on the previous page of the wizard. Use the buttons located above this list box to add and remove accounts.

•

Add - Select an account in the Browse or Search page to add it to the Override Accounts list.

•

Remove - Select an entry in the Override Accounts list to remove it.

Active Directory Database protection

When configured, Change Auditor prevents copying and other tampering attempts on the Active Directory database (NTDS.dit) file. Extraction of this file could lead to parsing of usernames and passwords resulting in a security breach.

This section includes a description of the Active Directory Database protection pages in the Administration Tasks tab, the procedure for creating an Active Directory Database protection template and description of the protection wizard used to define Active Directory Database protection template.

Active Directory Database protection page

This page displays when you select Active Directory Database from the Protection task list in the navigation pane of the Administration Tasks tab. From here, you can start the Active Directory Database protection wizard to define your Active Directory Database protection template to protect your Active Directory database from unauthorized access. You can also edit existing templates, disable and enable templates, and remove templates that are no longer being used.

The Active Directory Database protection page contains an expandable view of all previously defined Active Directory Database protection templates. To add new template, use the Add button.


	NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

Once added, the following information is provided for each template:

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the template is enabled or disabled. To enable and disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.

Exempt Process Filter

Displays a list of processes which bypass Active Directory database protection.

Active Directory Database protection templates

To create an Active Directory Database protection template:

Open the Administration Tasks tab.

Click Protection.

Select Active Directory Database in the Protection task list.

Click Add to open the Active Directory Database Protection wizard.

Enter a name for the Active Directory database protection template.

(Optional) Select processes to exclude from protection (for example, changes made by the processes specified on this page will be excluded from protection).

Select one or more processes from the process list and click Add to move these processes to the exclusion list. By default, all processes (except lsass.exe) will be protected from accessing the Active Directory database.


	NOTE: You can also view processes on a different server or enter a process not listed in the process list.

Click Finish or Finish and Assign to Agent Configuration to assign the template to an Agent Configuration immediately.

On the Configuration Setup dialog, use one of the following methods to assign this template to an agent configuration:

•

Select the newly created template and drag and drop it onto a configuration in the Configuration list.

•

Select a configuration from the Configuration list and ‘drag and drop’ it onto the newly created template.

•

Select a configuration, then select the newly created template, right-click and select Assign.

•

Select a configuration, then select the newly created template, click in the corresponding Assigned cell and click Yes.

If this configuration is not assigned to any agents, you will need to assign it to agents installed on your Domain Controllers to apply the Active Directory database protection.

NOTE:

•

Agents should be installed on all Domain Controllers to ensure auditing has complete coverage.

•

The auditing should be applied on all Domain Controllers to ensure complete coverage.

•

On the Agent Configuration page, select one or more agents from the agent list and click Assign.

•

On the Agent Assignment dialog, select the configuration definition to be assigned to the selected agents and click OK.

•

On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.


	NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.


	NOTE: Active Directory database protection templates will not record audit events when access to the Active Directory database file is protected unless an Active Directory database auditing template is also assigned to the Change Auditor agent. See Active Directory Database Auditing for additional information.

To modify an Active Directory Database protection template:

On the Active Directory Database Protection page, select the required template and click Edit. This opens the Active Directory Database Protection wizard where you can modify the current settings.

Click Finish to save your changes and return to the Active Directory Database Protection page.

To disable an Active Directory Database protection template:

Disabling a template temporarily stops protection without having to remove the protection template.

On the Active Directory Database protection page, place your cursor in the Status cell for the auditing template to disable, click the arrow control, and select Disabled.

-OR-

Right-click the template to disable and select Disable.

The entry in the Status column for the template changes to ‘Disabled’.

To enable the protection template, select Enable in the Status cell.

To delete an Active Directory Database protection template:

On the Active Directory Database Protection page, select the required template and click Delete | Delete Template.