Chat now with support
Chat with Support

Change Auditor for Authentication Services 7.0.1 - User Guide

Introduction

To capture activity performed with Authentication Services you need to:

•
Ensure that Authentication Services 4.0 (or later) is properly installed and configured.
•
Install the Change Auditor for Authentication Services license. If required, contact your Sales Representative for more information on obtaining a license.
•
Deploy agents on all Active Directory domain controllers in the forest in order to capture modifications to the Authentication Services configuration container. Note: The agent default configuration contains the required settings.
•
Enable and disable the required events.
* 
NOTE: Authentication Services auditing is only available if you have licensed Change Auditor for Authentication Services. If you do not have a valid license you can use the features, however, associated events are not captured. To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

Enable and disable events as required

You can enable or disable events to best suit your organization. To view or modify the current event auditing settings, use the Audit Events page, which is accessible through the Administration Tasks tab.

To disable/enable individual events:
1
Open the Administration Tasks tab.
2
Click Auditing.
3
Select Audit Events (under the Configuration heading in the Auditing task list) to display the Audit Events page.
4
To disable an event, use one of the following methods:
•
Select one or more enabled events and click Disable. (Use the Shift or Ctrl keys to select multiple events.)
•
Select an enabled event, place your cursor in the corresponding Status cell, click the arrow control and select Disabled from the drop-down menu.
•
Right-click an enabled event and select Disable.
5
To enable an event, use one of the following methods:
•
Select one or more disabled events and click Enable. (Use the Shift or Ctrl keys to select multiple events.)
•
Select a disabled event, place your cursor in the corresponding Status cell, click the arrow control and select Enabled from the drop-down menu.
•
Right-click a disabled event and select Enable.
* 
NOTE: You can also disable or enable an event using the Disable/Enable tool bar button at the top of the Event Details pane on a Search Results page.

Make changes and run a report

1
To test Authentication Services auditing, make some changes to the host being monitored.
For example:
•
change the Unix name of a Unix-enabled Active Directory group
•
rename an NIS object within Active Directory
•
move an Authentication Services computer object in an Active Directory domain
2
Select Start | All Programs | Quest | Change Auditor | Change Auditor Client to review the events generated.
3
Open the Searches tab.
4
Expand the Shared | Built-in | Authentication Services folder in the left pane.
5
Locate and double-click All Authentication Services events in last 30 days.
A new Search Results tab is added to the client displaying the events that were captured.
6
Double-click an event from the Search Results grid to display the event details for the selected event.

Authentication Services Searches/Reports

•
Introduction
•
Authentication Services built-in reports
•
Create custom searches
•
Search results
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating