Change Auditor 7.4 - User Guide

The Excluded Accounts Auditing page is displayed when Excluded Accounts is selected from the Auditing task in the navigation pane of the Administration Tasks tab. From this page you can launch the Excluded Accounts wizard to create a new template. You can also edit existing templates, disable/enable templates, and remove templates that are no longer being used.

The Excluded Accounts Auditing page contains an expandable view of all the Excluded Accounts templates that have been defined. To add a new template to this list, use the Add tool bar button. Once added, the following information is provided for each Excluded Accounts template:

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.

Account

This field is used for filtering data.

Operations

If specified, displays the event classes and/or facilities specified on the first page of the wizard that are to be excluded for the account.

Click the expansion box to the left of the Template Name to expand this view and display the following details about the template:

Type

Displays the type of account (i.e., user, computer or group) selected for exclusion as specified on the second page of the wizard.

Account

Displays the name of the account selected for exclusion.

Display Name

If available, displays the display name assigned to the excluded accounts listed.

Excluded Accounts templates


	NOTE: The cells directly under the main heading rows are used for filtering data. That is, as you enter characters into these cells, the client will redisplay the templates that meet the search criteria (i.e., comparison operator and characters entered). For more details about using the data filtering function provided throughout the client, see Filter data.

To exclude accounts from auditing, you must first create an Excluded Accounts template which specifies the user or computer accounts that are to be excluded. You can then add this template to an agent configuration, which then needs to be assigned to the appropriate agents.

To create an Excluded Accounts template:

Open the Administration Tasks tab and click Auditing.

Select Excluded Accounts (under the Configuration heading in the Auditing task list) to open the Excluded Accounts Auditing page.

Click Add to start the Excluded Accounts wizard which will step you through the process of creating an Excluded Accounts template.

On the first page of the wizard, enter the following information:

•

Template Name - Enter a name for the template.

•

Optionally select the facilities/event classes to be excluded.

•

To add individual event classes, select one or more events from the displayed list and click Add | Add This Event.

•

To add all the events in a facility, select an event from the facility and click Add | Add All Events in Facility.

After providing a name and optionally selecting the facilities/event classes to be excluded, click Next.

On the second page of the wizard, select the accounts that are to be excluded from auditing.

Use the Browse or Search pages to locate and select the account to be excluded. Click Add to add the selected account to the list box at the bottom of the page.

If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog.

Repeat this step to add additional accounts to the exclusion list.

(Optional) To specify a wildcard search expression to dynamically exclude additional user accounts from auditing, click Next.

On the Select Accounts to Exclude using Wildcards page, add the accounts to be excluded from auditing. In the text box, enter the wildcard expression (string of characters and/or wildcard character) to be used to search the Domain(NetBIOS)\NT 4 account name for matching users:

•

Use an asterisk (*) to substitute zero or more alphanumeric characters.

•

Use a question mark (?) to substitute a single alphanumeric character.

Click Add to add the string to the Account list.


	NOTE: This page should be used to exclude multiple users that match the wildcard search expression. Explicitly named user accounts must be specified on the previous page of the wizard.

After specifying the accounts to be excluded, click Finish to create the template without assigning it to an agent configuration.

Clicking Finish creates the template, closes the wizard and returns to the Excluded Accounts Auditing page, where the newly created template will now be listed.

To create the template and assign it to an agent configuration, expand the Finish button and click Finish and Assign to Agent Configuration.

This displays the Configuration Setup dialog, allowing you to select the agent configuration to which the template is to be assigned.


	NOTE: Back on the Excluded Accounts Auditing page, you can also use the Assign tool bar button to assign the selected template to an agent configuration. Clicking this button will display the Configuration Setup dialog allowing you to select the agent configuration to which this template is to be assigned.

On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.

To modify an Excluded Accounts template:


	NOTE: If you do not refresh the agent’s configuration, the agent will automatically check for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.