Chatta subito con l'assistenza
Chat con il supporto

Change Auditor 7.6 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Microsoft Entra Defender Microsoft 365 Logon Activity Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level SQL Extended Events

6805 – Enforcement | 6805(b) – Enforcement of Section 6801

| 6805(b) – Enforcement of Section 6801
(Executive Summary) - 6805(b) Enforcement of Section 6801

A summary report containing events from all of the following reports.

6805(b) – Detailed list of Change Auditor agent modifications
Who = All Users
What = Agent Service Has More Than 100 Events Waiting; Agent Service Has Reached a Critical Load; Agent Service Has Returned to Normal Operations; Change Auditor Agent Disconnected; Change Auditor Agent Uninstalled; Change Auditor Agent Connected
Where = All sources
When = Last 7 days
Origin = All workstations/servers
6805(b) – Detailed list of Change Auditor Internal Controls modifications
Who = All Users
What = Change Auditor Internal Auditing facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
6805(b) – Detailed list of critical group membership modifications
Who = All Users
What = Nested Member Added to Critical Enterprise Group; Nested Member Removed from Critical Enterprise Group; Member Added to Critical Enterprise Group; Member Removed from Critical Enterprise Group
Where = All sources
When = Last 7 days
Origin = All workstations/servers
6805(b) – Detailed list of file system permission modifications
Who = All Users
What = File Access Rights Changed; Folder Access Rights Changed; Local Share Permissions Changed; SYSVOL Folder Access Rights Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
6805(b) – Detailed list of GPO modifications
Who = All Users
What = Group Policy Item facility; Group Policy Object facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
6805(b) – Detailed list of interactive login policy modifications
Who = All Users
What = Interactive Logon: Message Title for Users Attempting to Log On Changed; Interactive Logon: Do Not Require CTRL+ALT+DEL Policy Changed; Interactive Logon: Message Text for Users Attempting to Log On Policy Changed; Interactive Logon: Do Not Display Last User Name Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
6805(b) – Detailed list of security log modifications
Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Policy Change Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Events Policy Changed; Audit: Audit the Access of Global System Objects Policy Changed; Audit: Audit Use of Backup and Restore Privilege Policy Changed; Audit: Shut Down System Immediately if Unable to Log Security Audit Policy Changed; Security Audit Log Rolled Over; Crash on Audit Fail Policy Changed; Shut Down The Computer When The Security Audit Log is Full Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers

GDPR

•
Audit and Accountability
•
Integrity and Confidentiality
•
Responsibility of the Controller
•
Security of Processing

Audit and Accountability

Audit and Accountability
•
Active Directory
•
Active Directory\Computers
•
Active Directory\Configuration
•
Active Directory\GPO Configuration
•
Active Directory\Group Policy
•
Active Directory\Organizational Unit
•
Active Directory\Users and Groups
•
Authentication Services
•
Messaging\Exchange
•
Messaging\Exchange Online
•
Microsoft SQL\Audit
•
Windows
Active Directory
- All Account Lockout Events
Who = All Users
What = Local User Account Locked; Local User Account Unlocked; User Account Locked; User Account Unlocked
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- All Object Restore Events
Who = All Users
What = Computer Added; Domain Added; Exchange Group Added (Exchange 2003); Group Object Added; Group Policy Object Added; Subordinate OU Added; User Object Added
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- All OU Events
Who = All Users
What = OU facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Changes to User Profiles in the last 30 days
Who = All Users
What = Home Folder Changed on User Object; Home Folder Mapped Drive Changed on User Object; Level of Control Changed for User Object; Primary Group ID Changed for User Object; Profile Path Changed on User Object
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- GDPR - Active Directory Database Events in last 30 days
Who = All Users
What = Active Directory Database facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Active Directory\Computers
- Computers added in last 30 days
Who = All Users
What = Computer Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Computers disabled in last 30 days
Who = All Users
What = Computer Account Disabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Computers enabled in last 30 days
Who = All Users
What = Computer Account Enabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Computers moved in last 30 days
Who = All Users
What = Computer Moved
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Computers removed in last 30 days
Who = All Users
What = Computer Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Computers renamed in last 30 days
Who = All Users
What = Computer Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Computers with a Service Pack applied in last 30 days
Who = All Users
What = Computer Service Pack Applied
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Computers with a Service Pack rolled back in last 30 days
Who = All Users
What = Computer Service Pack Rolled Back
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Active Directory\Configuration
- All Basic Domain Controller changes in last 30 days
Who = All Users
What = Append Parent Suffixes Option Changed; Connection DNS Registration Option Changed; Connection-Specific DNS Suffixes Changed; Contents of DNS Server List Changed; Contents of DNS Suffix List Changed; Default Gateway Changed; DHCP Enabled; DHCP Disabled; Disk Size Changed; IP Deny List Entry Added; IP Deny List Entry Removed; IPSEC Settings Changed; Memory Amount Changed; NIC Added; NIC Removed; Processor Speed Changed; Raw IP Allowed Protocols List Changed; Static IP Address Changed; Subnet Mask Changed; Use Connection Suffix in DNS Registration Option Changed; Use of Dynamic DNS Changed; Use Primary and Connection Specific Suffixes Flag Changed
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- All Forest changes performed in last 14 days
Who = All Users
What = Forest Configuration facility
Where = All sources
When = Last 14 days
Origin = All workstations/servers
- All Domain changes performed in last 14 days

Search generated for each domain in forest:

Who = All Users
What = Domain Configuration facility; Configuration Monitoring facility
Where = Domain Controller
When = Last 14 days
Origin = All domain controllers
- All Replication Changes performed in last 30 days
Who = All Users
What = Replication Transport facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- All Schema Changes performed in last 30 days
Who = All Users
What = Schema Configuration facility
Schema FSMO Role Owner Moved; Schema Modifications Allowed Flag Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- All Site Changes performed in last 30 days
Who = All Users
What = Site Added; Site Removed; Site Renamed; Site Link Added; Site Link Removed; Site Link Bridge Added; Site Link Bridge Removed
Site Configuration facility; Site Link Bridge Configuration facility; Connection Object facility; Site Link Configuration facility; Subnets facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Allow raw IP allowed protocols list changed in last 30 days
Who = All Users
What = Raw IP Allowed Protocols List Changed
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- Changes in Domain Controller Services
Who = All Users
What = Service Monitoring facility
Where = Domain Controller
When = Last 7 days
Origin = All domain controllers
- Changes in Domain Controller System State, Registry and Configuration Files
Who = All Users
What = Custom File System Monitoring facility; Custom Registry Monitoring facility; System Events facility; Service Monitoring facility
Where = Domain Controller
When = Last 7 days
Origin = All domain controllers
- Changes in domain-wide operations master roles
Who = All Users
What = RID FSMO Role Owner Moved; PDC FSMO Role Owner Moved; Infrastructure FSMO Role Owner Moved
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Changes in forest-wide operations master roles
Who = All Users
What = Domain FSMO Role Owner Moved; Schema FSMO Role Owner Moved
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Changes in LDAP policies
Who = All Users
What = Default Site Query Policy Object Changed; Linked Query Policy Object for Domain Controller Changed; Linked Query Policy for Site Changed; Query Policy Added; Query Policy Link for Domain Controller Changed; Query Policy Removed; Query Policy Setting Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Changes to audit policy settings
Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Policy Change Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Events Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Changes to DNS settings in last 30 days
Who = All Users
What = DHCP Enabled; DHCP Disabled; Static IP Address Changed; Subnet Mask Changed; Default Gateway Changed; Contents of DNS Server List Changed; Use Primary and Connection Specific Suffixes Flag Changed; Append Parent Suffixes Option Changed; Connection Specific DNS Suffix Changed; Contents of DNS Suffix List Changed; Use Connection Suffix in DNS Registration Option Changed; Connection DNS Registration Option Changed
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- Default gateway changes in last 30 days
Who = All Users
What = Default Gateway Changed
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- DHCP disabled in last 30 days
Who = All Users
What = DHCP Disabled
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- DHCP enabled in last 30 days
Who = All Users
What = DHCP Enabled
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- Domain Controller moved in the last 30 days
Who = All Users
What = Domain Controller Moved to Another OU
Where = All sources
When = Last 30 days
Origin = All domain controllers
- Global Catalog added to Domain Controller in last 30 days
Who = All Users
What = GC Added
Where = All sources
When = Last 30 days
Origin = All domain controllers
- Global Catalog removed from Domain Controller in last 30 days
Who = All Users
What = GC Removed
Where = All sources
When = Last 30 days
Origin = All domain controllers
- Hot fixes applied in last 30 days
Who = All Users
What = Hotfix Applied
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- Hot fixes rolled back in last 30 days
Who = All Users
What = Hotfix Rolled Back
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- Medium Severity changes in the last 30 days
Who = All Users
What = Severity | Medium
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Promotion or demotion of Domain Controllers
Who = All Users
What = Domain Controller Added to Domain; Domain Controller Removed from Domain; Domain Controller Renamed; GC Added; GC Removed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- All Basic Domain Controller changes in last 30 days
Who = All Users
What = Append Parent Suffixes Option Changed; Connection DNS Registration Option Changed; Connection-Specific DNS Suffixes Changed; Contents of DNS Server List Changed; Contents of DNS Suffix List Changed; Default Gateway Changed; DHCP Enabled; DHCP Disabled; Disk Size Changed; IP Deny List Entry Added; IP Deny List Entry Removed; IPSEC Settings Changed; Memory Amount Changed; NIC Added; NIC Removed; Processor Speed Changed; Raw IP Allowed Protocols List Changed; Static IP Address Changed; Subnet Mask Changed; Use Connection Suffix in DNS Registration Option Changed; Use of Dynamic DNS Changed; Use Primary and Connection Specific Suffixes Flag Changed
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- Schema Changes
Who = All Users
What = Schema Configuration facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Service Packs rolled back in last 30 days
Who = All Users
What = Domain Controller Service Pack Rolled Back
Where = All sources
When = Last 30 days
Origin = All domain controllers
- Static IP address changes in last 30 days
Who = All Users
What = Static IP Address Changed
Where = Domain Controller
When = Last 30 days
Origin = All domain controllers
- TCP/IP allowed list changes in last 30 days
Who = All Users
What = IP Deny List Entry Added; IP Deny List Entry Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Active Directory\GPO Configuration
- Changes in GPO assignments
Who = All Users
What = Group Policy Block Inheritance Setting Changed on OU; Group Policy Disabled Setting on Domain Changed; Group Policy Disabled Setting on OU Changed; Group Policy Inheritance Blocked Setting Changed; on Domain; Group Policy Link Added to OU; Group Policy Link Removed from OU; Group Policy Link Settings Modified; Group Policy Linked; Group Policy No Override Setting Changed on Domain; Group Policy Unlinked; Group Policy No Override Setting Changed on OU
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Changes in linked GPOs
Who = All Users
What = Linked Group Policy on Domain Changed; Linked Group Policy on OU Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Changes in the GPO assignments for all Sites
Who = All Users
What = Group Policy Link Added to Site; Group Policy Link Removed from Site; Group Policy Block Inheritance Setting Changed on Site; Group Policy No Override Setting Changed on Site; Group Policy Disabled Setting on Site Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- Group Policy block inheritance changes
Who = All Users
What = Group Policy Block Inheritance Setting Changed on OU; Group Policy Block Inheritance Setting Changed on Site; Group Policy Block Inheritance Setting Changed on Domain
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Group Policy disabled setting changes
Who = All Users
What = Group Policy Disabled Setting on OU Changed; Group Policy Disabled Setting on Site Changed; Group Policy Disabled Setting on Domain Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Active Directory\Group Policy
- All Group Policy Events
Who = All Users
What = Group Policy Link Added to OU; Group Policy Link Removed from OU; Group Policy Link Setting Modified; Group Policy Link Added to Site; Group Policy Link Removed from Site
Group Policy Item facility; Group Policy Object facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- All Group Policy Events Including GPOAdmin Initiator

Returns all Group Policy events, displaying the Initiator UserName and EventSource in the Search Results

Who = All Users
What = Group Policy subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout Tab - Selected Columns: Initiator UserName and EventSource are added to default list
Active Directory\Organizational Unit
- Organizational Unit policy changes last 30 days

Report generated for each domain

Who = All Users
What = Linked Group Policy on OU Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Organizational Units added in last 30 days
Who = All Users
What = Subordinate OU Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Organizational Units deleted in last 30 days
Who = All Users
What = Subordinate OU Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Organizational Units renamed in last 30 days
Who = All Users
What = Subordinate OU Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Active Directory\Users and Groups
- Group renamed (SAM account name) changes in last 30 days
Who = All Users
What = Group samAccountName Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Group renamed in last 30 days
Who = All Users
What = Group Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Group type changes in last 30 days
Who = All Users
What = Group Type Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- Nested group changes in last 30 days
Who = All Users
What = Nested Member Added to Critical Enterprise Group; Nested Member Removed from Critical Enterprise Group; Nested Member Added to Group; Nested Member Removed from Group
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Authentication Services
- All Failed Logons in the last 7 days
Who = All Users
What = User failed to authenticate through Kerberos, User failed to authenticate through NTLM, User failed to log on interactively, User failed to log on interactively from a remote computer, User failed to perform a network logon from a remote computer
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Info Tab = Fetch Every 10 Seconds
Messaging\Exchange
- All Exchange Administrative Group Events
Who = All Users
What = Exchange Administrative Group facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- All Email Address Policy Events
Who = All Users
What = Email Address Policy Added to Organization Configuration; Email Address Policy Email Address Filter List Changed; Email Address Policy Priority Changed; Email Address Policy Query Filter Changed; Email Address Policy Removed from Organization Configuration; Email Address Policy Renamed; Email Address Policy Storage Filter Changed; Distribution List - Email Address Policy Enabled Changed; Mailbox - Email Address Policy Enabled Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
- All Exchange Organization events in last 30 days
Who = All Users
What = Exchange Organization facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
- All Exchange Permission Tracking events in last 30 days
Messaging\Exchange Online
Microsoft 365 Exchange Online administrative cmdlets executed this week
Who = All Users
What = Microsoft 365 Exchange Online administration events, external and local
Where = All sources
When = This week
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped); User (Grouped)
Microsoft SQL\Audit
- All SQL Session Events in the last 24 hours
Who = All Users
What = SQL Session Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
- All SQL Stored Procedures Events in the last 24 hours
Who = All Users
What = SQL Stored Procedures Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
- All SQL TSQL Events in the last 24 hours
Who = All Users
What = SQL TSQL Event facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers

Microsoft SQL\Configuration

- Audit Access DB Object Changed
Who = All Users
What = Audit Access Database Object
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Windows
- All Registry Events
Who = All Users
What = Registry subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Responsibility of the Controller

24.2 - User Association

A summary report containing events from all of the following reports.

Detailed list of audit policy modifications
Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Policy Change Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Events Policy Changed; Audit: Audit the Access of Global System Objects Policy Changed; Audit: Audit the Use of Backup and Restore Privilege Policy Changed; Audit: Shut Down System Immediately if Unable to Log Security Audits Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Detailed list of Change Auditor agent modifications
Who = All Users
What = Agent Service Has More Than 100 Events Waiting; Agent Service Has Reached a Critical Load; Agent Service Has Returned to Normal Operations; Change Auditor Agent Disconnected; Change Auditor Agent Uninstalled; Change Auditor Agent Connected
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Detailed list of security log modifications
Who = All Users
What = Audit Account Logon Events Policy Changed; Audit Account Management Policy Changed; Audit Directory Service Access Policy Changed; Audit Logon Events Policy Changed; Audit Object Access Policy Changed; Audit Privilege Use Policy Changed; Audit Process Tracking Policy Changed; Audit System Events Policy Changed; Audit: Audit The Access of Global System Objects Policy Changed; Audit: Audit The Use of Backup and Restore Privilege Policy Changed; Audit: Shut Down System Immediately if Unable to Log Security Audits Policy Changed; Security Audit Log Rolled Over; Crash on Audit Fail Policy Changed; Shut Down the Computer When the Security Audit Log is Full Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
24.2 - Password Protection Mechanisms

A summary report containing events from all of the following reports.

Detailed list of account lockout policy modifications
Who = All Users
What = Account Lockout Threshold Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Detailed list of lockout duration policy modifications
Who = All Users
What = Account Lockout Duration Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Detailed list of password age policy modifications
Who = All Users
What = Maximum Password Age Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Detailed list of password complexity policy modifications
Who = All Users
What = Password Must Meet Complexity Requirements Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Detailed list of password history policy modifications
Who = All Users
What = Enforce Password History Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Detailed list of storing password policy modifications
Who = All Users
What = Store Passwords Using Reversible Encryption Policy Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione