When configured, Change Auditor prevents changes from occurring to a protected object regardless of who attempts to change the object and the tool or method used. Attempts to change or delete a protected object fail and an event is generated. These ‘failed’ events are identified in the client by displaying ‘Protected’ in the Result column on the Search Results page and Result field in an event’s detail pane.
See the Change Auditor User Guide for more information about defining the events to be captured based on result. |
This page displays when you select Active Directory from the Protection task list in the navigation pane of the Administration Tasks tab. From here, you can start the Active Directory Protection wizard to define critical Active Directory objects to protect from unauthorized modifications. You can also edit existing templates, disable and enable templates, and remove templates that are no longer being used.
NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access. |
Once added, the following information is provided for each template:
• |
Excluded from Protection - indicates that you selected the Allow option to allow only the selected accounts to change the protected objects. |
• |
Included in Protection - indicates that you selected the Deny option to allow all accounts to change the protected objects except for those selected. |
• |
• |
• |
The Active Directory protection templates are global settings and apply to all agents.
|
2 |
Click Protection. |
3 |
Select Active Directory in the Protection task list. |
4 |
Click Add to open the Active Directory Protection wizard to specify the Active Directory objects to protect. |
7 |
Click Add to add the object. Repeat this step as required to add more objects. |
8 |
By default, the create, modify attributes, and delete operations are selected; however, you can change this by using the drop-down arrow in the Operations cell in the list box and selecting or clearing the different operations. |
9 |
By default, the scope of coverage is for This object only; however, you can change this by using the drop-down arrow in the Scope cell in the list box and selecting one of the other two options: |
10 |
By default, all attributes for the object will be protected. However, if you want to protect individual attributes instead, click Next and select one of the following options to activate the attributes list: |
12 |
NOTE: Allow is selected by default indicating that the selected users or groups can change the protected objects. However, you can select the Deny option and select individual users or groups that are not allowed to change the protected objects. When using the Deny option, you are allowing all users and groups to change the protected objects except for those selected on this page. |
13 |
On the next page of the wizard, you can schedule when to enforce the protection. You can either select to always run the protection or run only during specific times. To enable the protection only during specific times, select Protection is scheduled, and define when it should be enabled (hour blocks on a weekly basis). The times selected are the local agent time where the template is applied. |
• |
Protect access from all locations: Protection is always enabled regardless of the location. |
• |
Protect access only from select locations: Protection is only enabled for the specified locations. |
• |
Disable protection only for select locations: Protection is disabled for the selected locations. Enabled everywhere else. |
• |
Protect access from all unknown locations: All Active Directory requests from locations that cannot be determined by the Change Auditor agent will be protected. |
15 |
Click Finish to save the protection template, close the wizard and return to the Active Directory Protection page. |
2 |
Click Finish to save your changes and return to the Active Directory Protection page. |
• |
Place your cursor in the Status cell for the protection template to disable, click the arrow control, and select Disabled |
2 |
• |
Place your cursor in the Status cell for the required object, click the arrow control, and select Disabled. |
• |
Right-click the object and click Disable. |
2 |
1 |
On the Active Directory Protection page, select the required template and click Delete | Delete Template. |
2 |
Click Yes to confirm. |
1 |
On the Active Directory Protection page, select the required object and click Delete | Delete Object. |
2 |
Click Yes to confirm. |
1 |
On the Active Directory Protection page, select the required account and click Delete | Delete Override Account. |
2 |
Click Yes to confirm. |
1 |
On the Active Directory Protection page, select the required account and click Delete | Delete Administration Account. |
2 |
Click Yes to confirm. |
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Feedback 利用規約 プライバシー Cookie Preference Center