Return
-
Title
Are there components that should be monitored to ensured they were not changed outside of RMAD? -
Description
We want to monitor key items in RMAD for changes. These should be things that should not be changing unless we initiated the change -
Resolution
The following are suggestions on key components that could be monitored:
- Changes in the ERDiskAD.mdb and Backups.mdb files (C:\ProgramData\Quest\Recovery Manager for Active Directory, or C:\ProgramData\Quest\Recovery Manager for Active Directory). Note: The Backups.mdb file will change each time a backup session runs
- Monitor for pre-installed backup agents being removed
- Monitor for Forest Recovery Agent being removed
- Changes to the Console and Agent certificates located in the Computer Personal store on the RMAD server
- Monitor the Backup file locations to ensure that files are not modified or removed other than by RMAD
- Monitor for changes to the Forest Recovery Project