How does one create a search to show all Active Directory related changes but at the same time, exclude DNS related events from this search?
Some customers may wish to show all Active Directory related changes in a search but may not want to see DNS related changes.
- Start by copying the built-in search in the ChangeAuditor Client, called "All Active Directory Events", paste it to any folder of your choice, and rename it accordingly.
- Next, show the properties of this search by right-clicking on the copied search and clicking on "Show Properties".
- Click on the "What" tab of this search, and then click "Add".
- In the "Facility" column, type "DNS", you will then see a number of entries for both "DNS Service" as well as "DNS Zone", highlight one event from each of these facilities and then click "Add | All Events in Facility".
- Click (enable) the option near the bottom left for "Exclude the Above Selection(s)" and then press "OK".
- Save and run this search, it should now show all Active Directory events without DNS related events.