With the CA and GPOAdmin integration, some of the events recorded by CA will have the Initiator name in the event. This Initiator name is the account that is logged into the GPOAdmin client performing actions in GPOAdmin. Even with the integration, the Initiator name is not always populated due to how the GPO is processed in AD. For example, the following is a high-level overview of what would be some of the typical CA events seen when modifying a GPO using GPOAdmin:
- The user logged into GPOAdmin actions to modify the settings of a GPO
- CA records an event for the creation of a new GPO (the working copy GPO). The who of the event will show the GPOAdmin service account and the initiator will show the name of the user who was logged into GPOAdmin
- CA records a rename event for the new GPO
- CA records a permission change for the new GPO, granting the user logged into GPOAdmin rights to the working copy GPO
- CA records modification events performed on the working copy GPO. The who of these events show the user logged into GPOAdmin and the initiator blank as the initiator and the who are the same
- Once the GPO is checked in, there are number of CA events recorded with the who being the GPOAdmin service account and the initiator blank. This is due to the work of importing the settings from the working copy to the live copy being performed in Sysvol, outside of GPOAdmin. It is the same processes that are performed if the GPO was edited in GPMC. GPOAdmin has no knowledge of what is being performed with these AD operations and cannot communicate to CA who the initiator is as they happened outside of all the GPOAdmin processes. As such, there is no initiator.
- Approval is requested in GPOAdmin
- The Approver approves and deploys the GPO. This will generate CA events where the who is the GPOAdmin service account and the initiator is the name of the approver. The events where the initiator is the name of the approver, and the action logged in the CA was the version attribute was changed on the GPO, are the events that show when the GPO was deployed, and who performed the deployment
GPOAdmin provides the initiator name to CA using CA APIs. Please note, you will see a considerable amount CA GPO event generated when performing actions in GPOAdmin. This is due to the way GPOAdmin processes GPOs and how they get deployed to the live environment.
STATUS
Enhancement request number TF00596307 has been submitted to Development for consideration in a future release of Change Auditor to improve the integration between Change Auditor and GPOAdmin.
