Chat now with support
Chat with Support

Change Auditor for Active Directory 7.0.4 - User Guide

Active Directory object protection

When configured, Change Auditor prevents changes from occurring to a protected object regardless of who attempts to change the object and the tool or method used. Attempts to change or delete a protected object fail and an event is generated. These ‘failed’ events are identified in the client by displaying ‘Protected’ in the Result column on the Search Results page and Result field in an event’s detail pane.

See the Change Auditor User Guide for more information about defining the events to be captured based on result.

Active Directory protection page

This page displays when you select Active Directory from the Protection task list in the navigation pane of the Administration Tasks tab. From here, you can start the Active Directory Protection wizard to define critical Active Directory objects to protect from unauthorized modifications. You can also edit existing templates, disable and enable templates, and remove templates that are no longer being used.

The Active Directory protection page contains an expandable view of all previously defined Active Directory protection templates. To add new template, use the Add button.

Once added, the following information is provided for each template:

Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.
Excluded from Protection - indicates that you selected the Allow option to allow only the selected accounts to change the protected objects.
Included in Protection - indicates that you selected the Deny option to allow all accounts to change the protected objects except for those selected.

Click the expansion box to the left of the template name to expand this view and display the following details for each template:

For Protect Only and Protect Except, click the expansion box to the left of the field to display the individual attributes included in the protection template.

Active Directory protection templates

The Active Directory protection templates are global settings and apply to all agents.

NOTE:  
If you are planning to use multiple Active Directory Protection templates, see the Change Auditor Technical Insight Guide for more information about how multiple protection templates are evaluated.
2
Click Protection.
3
Select Active Directory in the Protection task list.
4
Click Add to open the Active Directory Protection wizard to specify the Active Directory objects to protect.
6
Use the Browse or Search pages to locate and select the object to protect. Click Add to add the object. Repeat this step to add more objects.

The file must follow this format:

<Canonical Name>, <Protection Scope>, <Protected Operation 1><Protected Operation 2> <Protected Operation n>

Valid protection scope values include:

Valid protected operations include:

The import supports the list separator defined for the locale of the operating system.

After you have the file created, select Import, browse to the file, and click Open.
8
By default, the scope of coverage is for This object only; however, you can change this by using the drop-down arrow in the Scope cell in the list box and selecting one of the other two options:
NOTE: Allow is selected by default indicating that the selected users or groups can change the protected objects. However, you can select the Deny option and select individual users or groups that are not allowed to change the protected objects. When using the Deny option, you are allowing all users and groups to change the protected objects except for those selected on this page.
12
On the next page of the wizard, you can schedule when to enforce the protection. You can either select to always run the protection or run only during specific times. To enable the protection only during specific times, select Protection is scheduled, and define when it should be enabled (hour blocks on a weekly basis). The times selected are the local agent time where the template is applied.
Protect access from all locations: Protection is always enabled regardless of the location.
Protect access only from select locations: Protection is only enabled for the specified locations.
Disable protection only for select locations: Protection is disabled for the selected locations. Enabled everywhere else.
Protect access from all unknown locations: All Active Directory requests from locations that cannot be determined by the Change Auditor agent will be protected.
14
Click Finish to save the protection template, close the wizard and return to the Active Directory Protection page.

If you are in the authorized accounts list at template creation time, you may find yourself locked out later if someone else in the authorized accounts list decides to edit the template and remove you.

2
Click Finish to save your changes and return to the Active Directory Protection page.

Disabling a template temporarily stops protection for the specified objects without having to remove the protection template.

Place your cursor in the Status cell for the protection template to disable, click the arrow control, and select Disabled
The entry in the Status column for the template changes to ‘Disabled’.
Place your cursor in the Status cell for the required object, click the arrow control, and select Disabled.
The entry in the Status column for the object changes to ‘Disabled’.
2
Click Yes to confirm.
2
Click Yes to confirm.
2
Click Yes to confirm.
2
Click Yes to confirm.

Active Directory Protection wizard

The Active Directory Protection wizard opens when you click Add or Edit on the Active Directory Protection page. Using this wizard you can define the Active Directory objects and attributes to protect from unauthorized modifications.

Select Active Directory objects to protect page: On the first page of the wizard, enter a name for the template and select the Active Directory objects to protect.

Template Name

Enter a descriptive name for the protection template.

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the Active Directory objects to protect.

After you have selected an object, click Add to add it to the list.

After you have the file created, select Import, browse to the file, and click Open.

If any objects cannot be found, you can copy the results (ctrl+c) from the list into the clipboard so that you can use the information to locate any issues and make the necessary adjustments.

CSV File Details

The file must follow this format:

<Canonical Name>, <Protection Scope>, <Protected Operation 1><Protected Operation 2> <Protected Operation n>

Valid protection scope values include:

Valid protected operations include:

The import supports the list separator defined for the locale of the operating system.

Search page

Use the controls at the top of the Search page to search your environment to locate an Active Directory object to protect.

After you have selected an object, click Add to add it to the list.

Options page

Use the Options page to modify the search options used to retrieve directory objects.

Object list

The list box across the bottom of the page displays the object(s) selected for protection. Use the buttons located above this list box to add and remove objects.

 

Add - Select an object in the Browse or Search page and add it to the Object list.
Remove - Select an entry in the Object list and remove it from the template.

By default, the create, modify attributes and delete operations are selected. To change this use the drop-down arrow in the Operations cell and select/clear operations.

By default, the scope of coverage is set to This object only. To change this setting, use the drop-down menu in the Scope cell to select a different scope.

For example, if you protect an OU and set an option with child objects, then all objects under the OU are also protected. If you protect a group, nested groups are not protected.

(Optional) Select Attributes to Protect page: By default all attributes for the selected objects are protected. However, you can protect individual attributes or to exclude individual attributes from protection.

All Attributes

Select this option to protect all attributes for the selected object.

Only Selected

Select this option to protect individual attributes. Selecting this option will activate the list boxes on this page allowing you to select the individual attributes to be protected.

 

All EXCEPT Selected

Select this option to protect all attributes EXCEPT those selected. Selecting this option will activate the list boxes on this page allowing you to select the individual attributes that are not to be protected.

 

Attributes list

The list box to the left displays all the available attributes which may be selected for inclusion in the protection template.

NOTE: This list box is not enabled when All Attributes is selected.

Add

Use the Add button to move the attributes selected in the Attributes list over to the Selected Attributes list.

 

Remove

Use the Remove button to move the attributes selected in the Selected Attributes list back over to the Attributes list.

 

Selected Attributes list

The list box to the right displays the attributes to be included in the protection template.

NOTE: This list box is not enabled when the All Attributes option is selected.

 

(Optional) Select Attribute Flags to Protect page: If you have selected to protect the userAccountControl attribute, you can select to protect specific attribute flags on this page. By default, all flags are selected. Clear the ALL checkbox to select specific flags and click Next.

Attributes Flags list

The list displays all the available attributes flags which may be selected for inclusion in the protection template.

(Optional) Select Accounts Allowed (NOT Allowed) to Access Protected Objects page: By default all users and groups are prevented from changing the Active Directory objects selected for protection. However, you can specify users or groups that are allowed (not allowed) to change the protected objects.

Allow

The Allow option is selected by default indicating that the users and groups selected on this page will be the only accounts allowed to change the protected objects.

Use the Browse or Search page to select the user or group accounts.

 

Deny

Select the Deny option if you would like to allow all users and groups to change the protected objects EXCEPT for those selected on this page.

Use the Browse or Search page to select the user or group accounts.

 

Browse page

Displays a hierarchical view of the containers in your environment allowing you to locate and select the users or groups that are allowed (not allowed) to change the protected objects.

After you have selected an account, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to search your environment to locate the users or groups that are allowed (not allowed) to change the protected objects.

After you have selected an account, click Add to add it to the list.

Options page

Use the Options page to modify the search options used to retrieve directory objects.

 

Override Accounts list

The list box across the bottom of the page displays the user and group accounts that are allowed (not allowed) to change the protected objects selected on the previous page of the wizard. Use the buttons located above this list box to add and remove accounts.

Add — Select an account in the Browse or Search page and add it to the Override Accounts list.
Remove — Select an account in the Override Accounts list and remove it.

 

You can either select to always run the protection or run it only during specific times.

To enable the protection only during specific times, select the Protection scheduled option, and define when it should be enabled (hour blocks on a weekly basis). The times selected are the local agent time where the template is applied.

When the schedule is disabled, all options are disabled with it, including any denied access to the specified users.

The scheduling options override all other protection settings.

Control when the protection is enabled based on the location. Location refers to the computer that is attempting to access the resource that is protected. Select from the following options:

NOTE: Protect access from all unknown locations: All requests from locations that cannot be determined by the Change Auditor agent will be protected. If you have denied specific users or groups access to protected objects, but you have specified locations that can access the protected object, the denied user or group will be able to access the protected objects from these locations.

The location options override all other protection settings.

By default members of the Change Auditor Administrators group are authorized to access the Administration Tasks tab and perform administration tasks, including defining Active Directory and Group Policy protection; however, after you enter a user or group account here you are relinquishing your rights to modify the selected protection template to the users or groups specified on this page of the protection wizard.

Browse page

Displays the hierarchical view of the containers in your environment allowing you to locate and select the users or groups that will be authorized to manage this protection template.

After you have selected an account, click Add to add it to the list.

Search page

Use the controls at the top of the Search page to search your environment to locate the users or groups that will be authorized to manage this protection template.

After you have selected an account, click Add to add it to the list.

Options page

Use the Options page to modify the search options used to retrieve directory objects.

 

Administration Accounts list

The list box across the bottom of the page displays the user and group accounts authorized to manage this protection template.

Use the buttons located above this list box to add and remove accounts.

Add — Select an account in the Browse or Search page and add it to the list.
Remove — Select an account in the Administration Accounts list and remove it.
Related Documents