Return
-
Title
What format does ChangeAuditor for Active Directory real-time rules require when specifying an object -
Description
What format does ChangeAuditor for Active Directory real-time rules expect when specifying a specific 'Object' in the matching criteria?For example, the rule:ChangeAuditor for Active Directory/Successful Change Tracking/Active Directory Object Changes/Active Directory Object Was Successfully Modified. -
Cause
The object name is matched to the corresponding entry in the event. In this case, the event contains the object name in the distinguished name format. -
Resolution
ChangeAuditor for AD (InTrust for AD) log rules expect the 'distinguishedName' attribute value for the object name.For Example:CN=User1,CN=Users,DC=domain,DC=comOne method to retrieve this value is via Active Directory Users and Computers (ADUC).1. Ensure 'Advanced Features' is enabled.2. Right-click and select 'Properties' on the object in question.3. Select the 'Attribute Editor' tab.4. Locate the 'distinguishedName' attribute and click 'View'.5. Copy the value for use in the real-time rule 'Object' parameter.