• |
PowerShell Execution policy must be set to ‘AllSigned’, ‘RemoteSigned’ or ‘Unrestricted’ on the target Active Roles server. (For more information, see https://technet.microsoft.com/en-us/library/ee176961.aspx.) |
3 |
Expand Advanced Options and select one of the following options: |
4 |
If you select the Deploy Scripts Only option, Change Auditor copies and runs the Active Roles integration PowerShell script on the Active Roles server which triggers Active Roles to retrieve the initiator information for all users and pass this information onto Change Auditor. |
5 |
If you select the Deploy Scripts and Excluded Accounts option, the Select Active Directory Objects dialog is displayed. Use either the Browse or Search page to locate and select a user or computer to exclude. Change Auditor then deploys the integration script that signals Active Roles to retrieve the initiator information for all accounts except for those specified for exclusion. |
6 |
Once successfully deployed, Success is displayed in the Deployment Results cell for the server. |
• |
A built-in report that retrieves all Active Directory changes, including changes initiated by Active Roles. Running this report also displays the Initiator UserName and EventSource columns in the search results. |
A Source field in the Event Details pane displays the name of the application from which the change event was generated (Change Auditor, Active Roles, or GPOADmin). For change events generated by Active Roles or GPOADmin, the name of the user account that initiated the change is displayed in parentheses.
NOTE: If the Source field displays ‘ActiveRoles’ (instead of ‘ActiveRoles Server’) you are not using the latest integration scripts. To take advantage of the additional events and initiator account information captured using the integration scripts, ensure that you are running Active Roles 6.9 (or higher) with Change Auditor for Active Directory 6.0 (or higher). |
A built-in report is available which retrieves events for all Active Directory changes, including events initiated by Active Roles or GPOADmin. The search definition for this report also includes the initiator information (Initiator UserName and EventSource columns) in the search results.
2 |
To display the available built-in searches, expand and select the Shared | Built-in | All Events folder. |
3 |
Locate the All Active Directory Events Including ActiveRoles/GPOAdmin Initiator search and select the search definition and click Run. |
The Change Auditor database includes columns to record Active Roles and GPOADmin information. The columns are not displayed by default on a Search Results page for most searches. However, using the Layout tab you can add the following information for all searches:
• |
EventSource — for all events, the name of the application from which the event was generated (Change Auditor, Active Roles, or GPOADmin). |
• |
Initiator Mail — for all generated by Active Roles or GPOADmin, the email address of the user that initiated the change. |
• |
Initiator SID — for events generated by Active Roles or GPOADmin, the SID of the user that initiated the change. |
• |
Initiator UserName — for events generated by Active Roles or GPOADmin, the name of the user that initiated the change. |
2 |
Locate the columns (EventSource, Initiator Mail, Initiator SID, or Initiator UserName) in the Unselected Columns table. |
3 |
When using the Who tab to retrieve change events initiated by a specific user, changes initiated by Active Roles are not automatically included in the search. A check box is available on the Who tab which instructs Change Auditor to retrieve all change events initiated by the specified user, including those made through Active Roles and GPOADmin.
3 |
Click New to enable the Search Properties tabs. |
4 |
On the Who tab, click Add to add an active user, computer, or group to the ‘who’ list. |
6 |
After selecting one or more directory objects, click Select to save your selection and close the dialog. |
7 |
Back on the Who tab, select the Include Event Source Initiator check box. |
See the Change Auditor User Guide for more information about how to configure and enable email notifications and customize email content.
You can use the Active Roles console to manually remove previously deployed integration scripts.
1 |
Open Configuration | Policies | Administration. |
2 |
3 |
Remove Active Directory in the object list. |
4 |
Delete Change Auditor Integration Policy. |
5 |
6 |
Remove Active Directory in the object list. |
7 |
Delete Change Auditor Integration Deprovision Policy. |
|
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center