 |
 |
Copy-CASearch
Use this command to copy a search in the installation.
Example: Copying a search named “New Search for Employee” to a user’s private folder Searches\New and giving it a new name “All My Events” $connection = Connect-CAClient –InstallationName ‘DEFAULT’
$search = Get-CASearches $connection | ? {$_.Name –eq “New Search for Employee”}
Add-CASearch
Use this command to create a search in the installation.
Example: Adding a public search to the installation $connection = Connect-CAClient –InstallationName ‘DEFAULT’
$searchDefinition = Get-Content C:\Users\Admin\Documents\MySearchDefinition.xml
Move-CASearch
Use this command to move a search from one folder path to another in the installation.
Example: Moving the search named “All AD Queries in the last 30 days” to the private folder “Shared\SharePoint\” of the user with the SID “S-1-5-21-3623811015-3361044348-30300820-1013” $connection = Connect-CAClient –InstallationName ‘DEFAULT’
$search = Get-CASearches $connection | ? {$_.Name –eq “All AD Queries in the last 30 days”}
Remove-CASearch
Use this command to remove a public or private search from the installation.
Example 1: removing any search with the name “All Exchange Admin Events” from the installation $connection = Connect-CAClient –InstallationName ‘DEFAULT’
$search = Get-CASearches $connection | ? {$_.Name –eq “All Exchange Admin Events”}
Remove-CASearch $connection –Search $search
Example 2: Removing the search with the name “All Search Events”, owned by the user with the SID “S-1-5-21-3623811015-3361044348-30300820-1013”, which exists in that user’s folder “Security\Internal\Searches” from the installation $connection = Connect-CAClient –InstallationName ‘DEFAULT’
Remove-CASearch $connection –Search $search
Add-CASearchFolder
Use this command to create a search folder in the installation.
Table 40. Available parameters
A connection obtained by using the Connect-CAClient command.
A switch that specifies if the search is public. The default is private.
Example: Adding the public folder Searches\New to the installation $connection = Connect-CAClient –InstallationName ‘DEFAULT’
Add-CASearchFolder –Connection $connection –IsPublic –Path Shared\Searches\New
Remove-CASearchFolder
Use this command to remove a public or private folder from the installation.
Table 41. Available parameters
A connection obtained by using the Connect-CAClient command.
An optional parameter that removes the prompt before a search is removed.
Example: Removing the public folder in the installation Miscellaneous\OldSearches $connection = Connect-CAClient –InstallationName ‘DEFAULT’
Remove-CASearchFolder $connection –IsPublic –Path Shared\Miscellaneous\OldSearches
| |
|
Managing Active Directory Database auditing
Managing Active Directory database auditing is available through the following PowerShell commands:
New-CAADDatabaseTemplate
Use this command to create an Active Directory Database auditing template.
Table 42. Parameter description
A connection obtained by using the Connect-CAClient command.
The list of processes to exclude from auditing. The default is none.
Example: Create a new Active Directory Database auditing template Get-CAADDatabaseTemplates
Table 43. Parameter description
A connection obtained by using the Connect-CAClient command.
Example: Get a list of all Active Directory Database templates Get-CAADDatabaseTemplates -Connection $connection
Remove-CAADDatabaseTemplate
Use this command to delete an Active Directory Database auditing template.
Table 44. Parameter description
A connection obtained by using the Connect-CAClient command.
The CAADDatabaseTemplate object to remove. Obtain the template objects using the Get-CAADDatabaseTemplates command and filter to select the object to remove.
Removes template without prompting for a confirmation. The default is false.
Example: Remove a Active Directory Database auditing template Remove-CAADDatabaseTemplate -Connection $connection -Template $removeTemplate
Set-CAADDatabaseTemplate
Use this command to modify an Active Directory Database auditing template.
Table 45. Parameter description
Example: Modify an Active Directory Database auditing template
| |
|
Working with Active Directory Database protection templates
The following commands are available to manage Active Directory Database protection:
New-CAADDProtectionTemplate
Use this command to create an Active Directory Database protection template.
Table 46. Available parameters
A connection obtained by using the Connect-CAClient command.
The list of processes to exclude from protectoin. The default is none.
Example: Create an Active Directory Database protection template New-CAADDProtectionTemplate -Connection $connection -TemplateName TemplateSample
Set-CAADDProtectionTemplate
Use this command to modify an Active Directory Database protection template.
Table 47. Available parameters
A connection obtained by using the Connect-CAClient command.
The CAADDProtectionTemplate object to edit. Obtain the template objects using the Get-CAADDProtectionTemplates command and filter to select the object to update.
The list of processes to exclude from protectoin. The default is none.
Example: Create an Active Directory Database protection template Get-CAADDProtectionTemplates
Table 48. Available parameters
A connection obtained by using the Connect-CAClient command.
Example: Get a list of all Active Directory Database Protection templates Get-CAADDProtectionTemplates -Connection $connection
Remove-CAADDProtectionTemplate
Use this command to remove an Active Directory Database protection template.
Table 49. Available parameters
A connection obtained by using the Connect-CAClient command.
The PSCAProtectionTemplate object to remove.
Obtain the template objects using the Get-CAADDatabaseTemplates command and filter to select the object to remove.
Example: Remove an Active Directory Database protection template Remove-CAADProtectionTemplate -Connection $connection -Template $template
| |
|
Managing Windows File System auditing
Managing Windows file system auditing is available through the following PowerShell commands:
New-CAWindowsFSAuditObject
Use this command to define a folder or file paths to audit.
Table 50. Parameter description
Example: Monitoring a directory for all file types and all subfolders but excluding one subfolder Example: Monitoring a directory for one level for all file type except for .tmp files New-CAWindowsFSAuditTemplate
Use this command to create a Windows file system auditing template.
Table 51. Parameter description
Example: Create a Windows File System template Remove-CAWindowsFSAuditTemplate
Use this command to delete a Windows File System auditing template.
Table 52. Parameter description
A connection obtained by using the Connect-CAClient command.
The CAWindowsFSAuditTemplate object to remove. Obtain the template objects using the Get-CAWindowsFSAuditTemplates command and filter to select the object to remove.
Removes template without prompting for a confirmation. The default is false.
Example: Remove a Windows File System template Remove-CAWindowsFSAuditTemplate -Connection $connection -Template $removeTemplate
Set-CAWindowsFSAuditTemplate
Use this command to edit an existing Windows File System auditing template.
Table 53. Parameter description
Example: Excluding and changing the template name Get-CAWindowsFSAuditTemplates
Table 54. Parameter description
A connection obtained by using the Connect-CAClient command.
Example: Get a list of all Windows File Server templates Get-CAWindowsFSAuditTemplates -Connection $connection
Example: Get a template based on name Get-CAWindowsFSEventClassInfo
Use this command to get a list of all available Windows File System auditing event classes.
Table 55. Parameter description
A connection obtained by using the Connect-CAClient command.
Example: Get a list of all Windows File Server event classes
