Active Administrator 8.6.3 - User Guide

Event Definitions

Event definitions are used to create alerts and reports. The event definitions file, EventDefinitions.edx, is located in the Active Administrator\Server folder. Occasionally new event definition files are made available. You can import these new event definitions into your auditing database. See Managing event definitions.

 

Table 148. Event Definitions

Event	Type
Active Administrator AFS Service Started	Active Administrator
Active Administrator AFS Service Stopped	Active Administrator
Active Administrator Alert Added	Active Administrator
Active Administrator Alert Deleted	Active Administrator
Active Administrator Alert Updated	Active Administrator
Active Administrator Audit Agent Activated	Active Administrator
Active Administrator Audit Agent Configuration Changed	Active Administrator
Active Administrator Audit Agent Installation Failed	Active Administrator
Active Administrator Audit Agent Installation Succeeded	Active Administrator
Active Administrator Audit Agent Moved	Active Administrator
Active Administrator Audit Agent Uninstalled	Active Administrator
Active Administrator Delegation Added	Active Administrator
Active Administrator Delegation Broken	Active Administrator
Active Administrator Delegation Removed	Active Administrator
Active Administrator Delegation Repaired	Active Administrator
Active Administrator Delegation Updated	Active Administrator
Active Administrator DNS Test Failed	Active Administrator
Active Administrator DNS Test Succeeded	Active Administrator
Active Administrator Domain Controller Excluded	Active Administrator
Active Administrator Event Definition Disabled	Active Administrator
Active Administrator Event Definition Enabled	Active Administrator
Active Administrator Event Purge History Cleared	Active Administrator
Active Administrator Event Purged / Archived	Active Administrator
Active Administrator Global Alert Quiet Time Added	Active Administrator
Active Administrator Global Alert Quiet Time Changed	Active Administrator
Active Administrator Global Alert Quiet Time Removed	Active Administrator
Active Administrator GPO History Backups Purged	Active Administrator
Active Administrator GPO Rollback Completed	Active Administrator
Active Administrator GPO Rollback Failed	Active Administrator
Active Administrator GPO Rollback Started	Active Administrator
Active Administrator Group Policy Object Added to the Repository	Active Administrator
Active Administrator Group Policy Object Checked Into the Repository	Active Administrator
Active Administrator Group Policy Object Checked Out of the Repository	Active Administrator
Active Administrator Group Policy Object Published to Active Directory	Active Administrator
Active Administrator Group Policy Object Removed from the Repository	Active Administrator
Active Administrator Group Policy Object Restored	Active Administrator
Active Administrator new Domain Controller Discovered	Active Administrator
Active Administrator Trustee Added	Active Administrator
Active Administrator Trustee Removed	Active Administrator
Active Directory Backup Completed	Active Administrator
Active Directory Backup Failed	Active Administrator
Active Directory Backup Purge History Cleared	Active Administrator
Active Directory Backup Started	Active Administrator
Active Directory Backups Purged	Active Administrator
Active Directory Replication Test Failed	Active Administrator
Active Directory Replication Test Succeeded	Active Administrator
Active Directory Restore Completed	Active Administrator
Active Directory Restore Failed	Active Administrator
Active Directory Restore Started	Active Administrator
Active Directory Shared Folder Changed	Shared Folder
Active Directory Shared Folder Created	Shared Folder
Active Directory Shared Folder Deleted	Shared Folder
AD Object Changed	General
AD Object Created	General
AD Object Renamed / Moved	General
Audit Agent Database Connectivity Lost	Active Administrator
Audit Agent Database Connectivity Restored	Active Administrator
Azure AD Group Added	Azure AD
Azure AD Group Deleted	Azure AD
Azure AD Group Updated	Azure AD
Azure AD User Added	Azure AD
Azure AD User Deleted	Azure AD
Azure AD User Updated	Azure AD
Certificate Added to Repository	Active Administrator
Computer Account Changed	Computer
Computer Account Created	Computer
Computer Account Deleted	Computer
Contact Changed	Contact
Contact Created	Contact
Contact Deleted	Contact
Domain Master Changed	FSMO
Domain Trust Created (Windows 2000 only)	Trust
Event Log Cleared	Security
Global Distribution Group Changed	Group
Global Distribution Group Created	Group
Global Distribution Group Deleted	Group
Global Group Changed	Group
Global Group Created	Group
Global Group Deleted	Group
GPO Changed	Group Policy
GPO Created	Group Policy
GPO Deleted	Group Policy
GPO Password Complexity Disabled NOTE: The added alert will not state the name of the changed GPO; there is an action description only.	Group Policy
GPO Password Complexity Enabled NOTE: The added alert will not state the name of the changed GPO; there is an action description only.	Group Policy
GPO Security Group Filters Changed	Group Policy
Group Policy Links Changed	Group Policy
Group Type Changed	Group
Infrastructure Master Changed	FSMO
Kerberos authentication ticket (TGT) was requested	User
Kerberos Pre-Auth Failed (Bad Password)	User
Local Distribution Group Changed	Group
Local Distribution Group Created	Group
Local Distribution Group Deleted	Group
Local Group Changed	Group
Local Group Created	Group
Local Group Deleted	Group
Logged onto DC (Local)	User
Logged onto DC (Remote)	User
Logon Failed (Bad Password)	User
Logon Failed (NTLM - Bad Password)	User
Logon Failed (NTLM - Unknown Username)	User
Logon Failed (Unknown Username)	User
Member Added to BUILTIN Group	Group Membership
Member Added to Global Distribution Group	Group Membership
Member Added to Global Group	Group Membership
Member Added to Local Distribution Group	Group Membership
Member Added to Local Group	Group Membership
Member Added to Universal Distribution Group	Group Membership
Member Added to Universal Group	Group Membership
Member Removed from BUILTIN Group	Group Membership
Member Removed from Global Distribution Group	Group Membership
Member Removed from Global Group	Group Membership
Member Removed from Local Distribution Group	Group Membership
Member Removed from Local Group	Group Membership
Member Removed from Universal Distribution Group	Group Membership
Member Removed from Universal Group	Group Membership
Object Owner Changed	Security
Object Permissions Changed	Security
One Way Incoming Trust Created	Trust
One Way Outgoing Trust Created	Trust
OU Changed	Organizational Unit
OU Created	Organizational Unit
OU Deleted	Organizational Unit
PDC Master Changed	FSMO
Printer Changed	Printer
Printer Created	Printer
Printer Deleted	Printer
Rejected Simple LDAP Bind Requests	LDAP Signing
Repository Certificate Delete	Active Administrator
Repository Certificate Updated	Active Administrator
RID Master Changed	FSMO
Schema Master Changed	FSMO
Site Changed	Site
Site Created	Site
Site Deleted	Site
SMTP Virtual Directory Changed	Exchange Server
Subnet Changed	Subnet
Subnet Created	Subnet
Subnet Deleted	Subnet
System Audit Policy Was Changed	Group Policy
System Time was Changed	System
Trust Deleted	Trust
Trust Modified	Trust
Two Way Trust Created	Trust
Universal Distribution Group Changed	Group
Universal Distribution Group Created	Group
Universal Distribution Group Deleted	Group
Universal Group Changed	Group
Universal Group Created	Group
Universal Group Deleted	Group
Unsigned LDAP Client Details	LDAP Signing
User Account Changed	User
User Account Created	User
User Account Deleted	User
User Account Disabled	User
User Account Enabled	User
User Account Locked Out	User
User Account Type Changed	User
User Account Unlocked	User
User Attribute Changed	User
User Change Password Attempt Failed	User
User Change Password Attempt Succeeded	User
User Locked Workstation	Workstation
User Logoff	Workstation
User Logon (Interactive for Windows 2012 Server)	Workstation
User Logon (Interactive for Windows 2016 Server)	Workstation
User Logon (Interactive)	Workstation
User Logon (Remote Desktop)	Workstation
User Password Reset	User
User Unlocked Workstation	Workstation
Windows Shutdown	System
Windows Started	System

 

PowerShell cmdlets

Microsoft® Windows PowerShell® is a Windows® command-line shell and scripting language designed specifically for system administrators and built on top of the Microsoft .NET Framework. Active Administrator supports the use of PowerShell cmdlets.

Topics 

•	What are cmdlets?

•	Using Active Administrator cmdlets

•	Using cmdlets to get information about the Active Administrator server

•	Using cmdlets to manage the Active Administrator server

•	Using cmdlets to manage Active Administrator tasks

What are cmdlets?

What are cmdlets?

Windows PowerShell® has the concept of cmdlets. A cmdlet is a simple, single-function command that manipulates objects and is designed to be used in combination with other cmdlets.

If you already had Windows PowerShell installed on your computer before you installed Active Administrator®, the Active Administrator cmdlets were automatically installed and registered with Windows PowerShell.

The examples in this section show you leverage the cmdlets available in Active Administrator. These cmdlets allow you to perform many of the functions of Active Administrator in an automation environment. The cmdlets also can be of great use in any environment where a repetitive process involving Active Administrator is needed.

The complete set of cmdlets shipped with the module AA.ServerManagerPowerShellModule.dll is as follows.

 

NOTE: All cmdlets should be run while logged on as an Administrator. Some Active Administrator cmdlets must be run as an Administrator with elevated privileges (if UAC is enabled). The Active Administrator cmdlets should be used only by those familiar with Windows PowerShell. NOTE: Those scripts that run under standard privileges are marked with an asterisk, others require elevated privileges.

 

Table 149. AA Server Manager cmdlets for use with Windows PowerShell®

Cmdlet	Module	Reference
Clear-AFSCache	AA.ServerManagerPowerShellModule	Clearing the AFS cache
Get-AAFeaturesLicenseStatus*	AA.ServerManagerPowerShellModule	Getting the status of Active Administrator licenses
Get-AAWebServerConfiguration	AA.ServerManagerPowerShellModule	Getting configuration settings for the Web server
Get-ADSLoggingStatus	AA.ServerManagerPowerShellModule	Getting logging status for ADS
Get-ADSOperationStatus*	AA.ServerManagerPowerShellModule	Getting operation status for ADS
Get-ADSPort	AA.ServerManagerPowerShellModule	Getting the port number for ADS
Get-AFSLoggingStatus	AA.ServerManagerPowerShellModule	Getting logging status for AFS
Get-AFSOperationStatus*	AA.ServerManagerPowerShellModule	Getting operation status for AFS
Get-AFSPort	AA.ServerManagerPowerShellModule	Getting the port number for AFS
Get-AFSHTTPOperationStatus	AA.ServerManagerPowerShellModule	Getting operation status for the HTTP service
Get-FullTextSearchStatus	AA.ServerManagerPowerShellModule	Getting the status of Full-Text Search
Get-NotificationService OperationStatus*	AA.ServerManagerPowerShellModule	Getting operation status for the Active Administrator Notification Service
Set-AALicense	AA.ServerManagerPowerShellModule	Updating the Active Administrator license
Set-AAWebServerConfiguration	AA.ServerManagerPowerShellModule	Setting configuration for the Active Administrator Web server
Set-ADSPort	AA.ServerManagerPowerShellModule	Setting the port for ADS
Set-AFSAndADSStartup Account	AA.ServerManagerPowerShellModule	Setting the startup account for AFS and ADS
Set-AFSPort	AA.ServerManagerPowerShellModule	Setting the port for AFS
Set-NotificationServiceStartup Account	AA.ServerManagerPowerShellModule	Setting the startup account for the Active Administrator Notification Service
Switch-ADSLoggingStatus	AA.ServerManagerPowerShellModule	Switching logging status of ADS
Switch-ADSOperationStatus	AA.ServerManagerPowerShellModule	Switching operation status of ADS
Switch-AFSLoggingStatus	AA.ServerManagerPowerShellModule	Switching logging status of AFS
Switch-AFSOperationStatus	AA.ServerManagerPowerShellModule	Switching operation status of AFS
Switch-AFSHTTPOperationSatus	AA.ServerManagerPowerShellModule	Switching operation status of the HTTP service
Switch-FullTextSearchStatus	AA.ServerManagerPowerShellModule	Switching the setting of Full-Text Search
Switch-NotificationService OperationStatus	AA.ServerManagerPowerShellModule	Switching operation status of the Active Administrator Notification Service

Using Active Administrator cmdlets

Using Active Administrator cmdlets

 

IMPORTANT: All command utilities should be run while logged on as an Administrator. Some cmdlets must be run as an administrator with elevated privileges (if UAC is enabled). The cmdlets should be used only by those familiar with Windows PowerShell®.

The Active Administrator® cmdlets function very similarly to the included utilities in the AA Server Manager application. The cmdlets are located at C:\Program Files\Quest\Active Administrator\Server\PowerShell.

Viewing help

You can view help by typing the cmdlt name with no arguments or by using get-help.

Running cmdlets

You can run the cmdlets from the PowerShell console (right-click the cmdlet, and choose Run with PowerShell) or PowerShell ISE (open the cmdlet in ISE and click Run).

Using cmdlets manually

If you want to use the cmdlets manually, you must include the two cross-cutting scripts for configuration (ConfigAndLoadModule.ps1) and rights management (EnsureElevatedPrivileges.ps1).

•	ConfigAndLoadModule.ps1 loads the module and updates PowerShell configuration with necessary settings.

Example

if(-Not(&($PSScriptRoot + "\ConfigAndLoadModule.ps1"))){ exit; }

•

EnsureElevatedPrivileges.ps1 uses UAC to rerun the script at the given path with elevated privileges if it finds that the script was run without proper permissions granted. It accepts as a parameter the path to the script that is to be rerun. The script can run from another script as follows, with the caller path detected at run time.

 

NOTE: To run the elevated privileges cmdlet manually, the PowerShell should just be run as administrator.

Example

if(-Not(&($PSScriptRoot + "\EnsureElevatedPrivileges.ps1") -scriptPath $myinvocation.mycommand.definition)){ exit; }