Can a ChangeAuditor for Active Directory search / alert be created for groups which match a certa (4354904)

Can a ChangeAuditor for Active Directory search / alert be created for groups which match a certain naming convention only?

See 'Resolution' below.

Some customers may wish to create a search / alert for group changes but only for groups that match a certain naming convention rather than all groups.

This is possible in ChangeAuditor by doing to the following:

• Create a new search in the ChangeAuditor Client under the "Searches" tab.
• On the new search, click on the "What" tab.
• Click "Add", under the "Facility" column, type "Custom Group Monitoring".
• Select on any of the "Custom Group Monitoring" choices from the list below.
• Click "Add" and select "Add All Events in Facility", press "OK"
• On the "What" tab again, click "Add With Events" (dropdown arrow) | "Subsystem" | "Active Directory".
• Scope will be "This Object", Actions will be "All Actions" and "All Transports".
• In the lower pane, next to the "* Like" box, type "*GROUPNAME*" without the quotes, where "GROUPNAME" is the name or partial name of a group you would like to alert on, any groups matching this "GROUPNAME" in their name will be shown in the search results / alert.

Please note the same steps from the 'Resolution' section can be applied for both Computer and User objects as well, by using "Custom Computer Monitoring" or "Custom User Monitoring" and matching the Computer or User account, and using the "* Like" box to filter on either "*COMPUTERNAME*" or "*USERNAME*".